Demo Title
| Risk Level | Number of Alerts |
|---|---|
|
High
|
0
|
|
Medium
|
3
|
|
Low
|
3
|
|
False Positives:
|
0
|
| Name | Risk Level | Number of Instances |
|---|---|---|
| Absence of Anti-CSRF Tokens | Medium | 40 |
| Content Security Policy (CSP) Header Not Set | Medium | 48 |
| Missing Anti-clickjacking Header | Medium | 44 |
| Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) | Low | 62 |
| Server Leaks Version Information via "Server" HTTP Response Header Field | Low | 74 |
| X-Content-Type-Options Header Missing | Low | 68 |
| HTTP Response Code | Number of Responses |
|---|---|
| 404 Not Found |
4
|
| 200 OK |
87
|
| 302 Found |
2
|
| Technology | Version | Categories | Implies |
|---|---|---|---|
|
Adobe Flash
|
Programming languages
|
||
|
Cart Functionality
|
Ecommerce
|
||
|
DreamWeaver
|
Editors
|
||
|
Nginx
|
1.19.0
|
Web servers
Reverse proxies
|
|
|
PHP
|
5.6.40
|
Programming languages
|
|
|
Ubuntu
|
Operating systems
|
|
Medium |
Absence of Anti-CSRF Tokens |
|---|---|
| Description |
No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.
CSRF attacks are effective in a number of situations, including:
* The victim has an active session on the target site.
* The victim is authenticated via HTTP auth on the target site.
* The victim is on the same local network as the target site.
CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.
|
| URL | http://testphp.vulnweb.com |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 238 bytes. |
GET http://testphp.vulnweb.com HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:51:59 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/artists.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5328 |
| Response Body - size: 5,328 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class='story'><a href='artists.php?artist=1'><h3>r4w8173</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=2'><h3>Blad3</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=3'><h3>lyzae</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6251 |
| Response Body - size: 6,251 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: r4w8173</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=1'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: Blad3</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=2'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: lyzae</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=3'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 284 bytes. |
GET http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/categories.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/categories.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6115 |
| Response Body - size: 6,115 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture categories</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">categories</h2> <div class='story'><a href='listproducts.php?cat=1'><h3>Posters</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=2'><h3>Paintings</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=3'><h3>Stickers</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=4'><h3>Graffity</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/disclaimer.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/disclaimer.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5524 |
| Response Body - size: 5,524 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>disclaimer</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">Disclaimer</h2> <div class="story"> <h6>Please read carefully</h6> <p>This website is created to demonstrate the abilities of Acunetix new product <strong>WEB Vulnerability Scanner</strong>.</p> It is not intended to be a real online shop. Also this website was constructed with common web programming errors so it is buggy. <p>Please do not post any confidential information on this site. Do not give any creditcard number or real address, nor e-mail or website addresses.</p> <p>Information you post on this site are by no means private nor protected!</p> <p>All images on this site were generated with fre software <a href="http://www.eclectasy.com/Fractal-Explorer/index.html" target="_blank"> <strong>Fractal Explorer</strong></a>.</p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="" method="post" name="faddentry"> |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5390 |
| Response Body - size: 5,390 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong></strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5390 |
| Response Body - size: 5,390 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong></strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/index.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7994 |
| Response Body - size: 7,994 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>r4w8173</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5193 |
| Response Body - size: 5,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Blad3</h2><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=3 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7880 |
| Response Body - size: 7,880 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Posters</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5311 |
| Response Body - size: 5,311 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Paintings</h2><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/login.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name="loginform" method="post" action="userinfo.php"> |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/login.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5523 |
| Response Body - size: 5,523 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>login page</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h3>If you are already registered please enter your login information below:</h3><br> <form name="loginform" method="post" action="userinfo.php"> <table cellpadding="4" cellspacing="1"> <tr><td>Username : </td><td><input name="uname" type="text" size="20" style="width:120px;"></td></tr> <tr><td>Password : </td><td><input name="pass" type="password" size="20" style="width:120px;"></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="login" style="width:75px;"></td></tr> </table> </form> </div> <div class="story"> <h3> You can also <a href="signup.php">signup here</a>.<br> Signup disabled. Please use the username <font color='red'>test</font> and the password <font color='red'>test</font>. </h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/login.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/login.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5523 |
| Response Body - size: 5,523 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>login page</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h3>If you are already registered please enter your login information below:</h3><br> <form name="loginform" method="post" action="userinfo.php"> <table cellpadding="4" cellspacing="1"> <tr><td>Username : </td><td><input name="uname" type="text" size="20" style="width:120px;"></td></tr> <tr><td>Password : </td><td><input name="pass" type="password" size="20" style="width:120px;"></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="login" style="width:75px;"></td></tr> </table> </form> </div> <div class="story"> <h3> You can also <a href="signup.php">signup here</a>.<br> Signup disabled. Please use the username <font color='red'>test</font> and the password <font color='red'>test</font>. </h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name='f_addcart' method='POST' action='cart.php'> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6428 |
| Response Body - size: 6,428 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The shore</h2><div class='story'><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $500</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='500'><input type='hidden' name='addcart' value='1'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6428 |
| Response Body - size: 6,428 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The shore</h2><div class='story'><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $500</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='500'><input type='hidden' name='addcart' value='1'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name='f_addcart' method='POST' action='cart.php'> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6368 |
| Response Body - size: 6,368 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mistery</h2><div class='story'><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $800</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='800'><input type='hidden' name='addcart' value='2'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6368 |
| Response Body - size: 6,368 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mistery</h2><div class='story'><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $800</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='800'><input type='hidden' name='addcart' value='2'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name='f_addcart' method='POST' action='cart.php'> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6401 |
| Response Body - size: 6,401 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The universe</h2><div class='story'><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $986</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='986'><input type='hidden' name='addcart' value='3'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6401 |
| Response Body - size: 6,401 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The universe</h2><div class='story'><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $986</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='986'><input type='hidden' name='addcart' value='3'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name='f_addcart' method='POST' action='cart.php'> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6453 |
| Response Body - size: 6,453 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Walking</h2><div class='story'><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $1000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='1000'><input type='hidden' name='addcart' value='4'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6453 |
| Response Body - size: 6,453 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Walking</h2><div class='story'><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $1000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='1000'><input type='hidden' name='addcart' value='4'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=5 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name='f_addcart' method='POST' action='cart.php'> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=5 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6382 |
| Response Body - size: 6,382 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mean</h2><div class='story'><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $460</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='460'><input type='hidden' name='addcart' value='5'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=5 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=5 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6382 |
| Response Body - size: 6,382 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mean</h2><div class='story'><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $460</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='460'><input type='hidden' name='addcart' value='5'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=6 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name='f_addcart' method='POST' action='cart.php'> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=6 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6454 |
| Response Body - size: 6,454 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Thing</h2><div class='story'><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 99 cm x 200 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $10000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='10000'><input type='hidden' name='addcart' value='6'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=6 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=6 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6454 |
| Response Body - size: 6,454 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Thing</h2><div class='story'><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 99 cm x 200 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $10000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='10000'><input type='hidden' name='addcart' value='6'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=7 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name='f_addcart' method='POST' action='cart.php'> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=7 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5734 |
| Response Body - size: 5,734 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Trees</h2><div class='story'><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>bla bla bla</p><h3>Long description</h3><p>bla bla bla long</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p>the price of this item is: $15000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='15000'><input type='hidden' name='addcart' value='7'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=7 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=7 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5734 |
| Response Body - size: 5,734 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Trees</h2><div class='story'><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>bla bla bla</p><h3>Long description</h3><p>bla bla bla long</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p>the price of this item is: $15000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='15000'><input type='hidden' name='addcart' value='7'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/signup.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form name="form1" method="post" action="/secured/newuser.php"> |
| Request Header - size: 296 bytes. |
GET http://testphp.vulnweb.com/signup.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/login.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6033 |
| Response Body - size: 6,033 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>signup</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h2 id="pageName">Signup new user</h2> <h4>Please do not enter real information here.</h4> <h4>If you press the submit button you will be transferred to asecured connection.</h4> <form name="form1" method="post" action="/secured/newuser.php"> <table border="0" cellspacing="1" cellpadding="4"> <tr><td valign="top">Username:</td><td><input type="text" name="uuname" style="width:200px"></td></tr> <tr><td valign="top">Password:</td><td><input type="password" name="upass" style="width:200px"></td></tr> <tr><td valign="top">Retype password:</td><td><input type="password" name="upass2" style="width:200px"></td></tr> <tr><td valign="top">Name:</td><td><input type="text" name="urname" style="width:200px"></td></tr> <tr><td valign="top">Credit card number:</td><td><input type="text" name="ucc" style="width:200px"></td></tr> <tr><td valign="top">E-Mail:</td><td><input type="text" name="uemail" style="width:200px"></td></tr> <tr><td valign="top">Phone number:</td><td><input type="text" name="uphone" style="width:200px"></td></tr> <tr><td valign="top">Address:</td><td><textarea wrap="soft" name="uaddress" rows="5" style="width:200px"></textarea></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="signup" name="signup"></td></tr> </table> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/signup.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 296 bytes. |
GET http://testphp.vulnweb.com/signup.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/login.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6033 |
| Response Body - size: 6,033 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>signup</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h2 id="pageName">Signup new user</h2> <h4>Please do not enter real information here.</h4> <h4>If you press the submit button you will be transferred to asecured connection.</h4> <form name="form1" method="post" action="/secured/newuser.php"> <table border="0" cellspacing="1" cellpadding="4"> <tr><td valign="top">Username:</td><td><input type="text" name="uuname" style="width:200px"></td></tr> <tr><td valign="top">Password:</td><td><input type="password" name="upass" style="width:200px"></td></tr> <tr><td valign="top">Retype password:</td><td><input type="password" name="upass2" style="width:200px"></td></tr> <tr><td valign="top">Name:</td><td><input type="text" name="urname" style="width:200px"></td></tr> <tr><td valign="top">Credit card number:</td><td><input type="text" name="ucc" style="width:200px"></td></tr> <tr><td valign="top">E-Mail:</td><td><input type="text" name="uemail" style="width:200px"></td></tr> <tr><td valign="top">Phone number:</td><td><input type="text" name="uphone" style="width:200px"></td></tr> <tr><td valign="top">Address:</td><td><textarea wrap="soft" name="uaddress" rows="5" style="width:200px"></textarea></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="signup" name="signup"></td></tr> </table> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 372 bytes. |
POST http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/product.php?pic=1 content-length: 19 |
| Request Body - size: 19 bytes. |
price=500&addcart=1
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | <form action="" method="post" name="faddentry"> |
| Request Header - size: 373 bytes. |
POST http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/guestbook.php content-length: 33 |
| Request Body - size: 33 bytes. |
name=ZAP&text=&submit=add+message
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5393 |
| Response Body - size: 5,393 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong>ZAP</strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 373 bytes. |
POST http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/guestbook.php content-length: 33 |
| Request Body - size: 33 bytes. |
name=ZAP&text=&submit=add+message
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5393 |
| Response Body - size: 5,393 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong>ZAP</strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/search.php?test=query |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | <form action="search.php?test=query" method="post"> |
| Request Header - size: 367 bytes. |
POST http://testphp.vulnweb.com/search.php?test=query HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com content-length: 25 |
| Request Body - size: 25 bytes. |
searchFor=ZAP&goButton=go
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4772 |
| Response Body - size: 4,772 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>search</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>searched for: ZAP</h2></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| Instances | 40 |
| Solution |
Phase: Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, use anti-CSRF packages such as the OWASP CSRFGuard.
Phase: Implementation
Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.
Phase: Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).
Note that this can be bypassed using XSS.
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Note that this can be bypassed using XSS.
Use the ESAPI Session Management control.
This control includes a component for CSRF.
Do not use the GET method for any request that triggers a state change.
Phase: Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.
|
| Reference |
https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
https://cwe.mitre.org/data/definitions/352.html |
| Tags |
OWASP_2021_A01
WSTG-v42-SESS-05 OWASP_2017_A05 CWE-352 |
| CWE Id | 352 |
| WASC Id | 9 |
| Plugin Id | 10202 |
|
Medium |
Content Security Policy (CSP) Header Not Set |
|---|---|
| Description |
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
|
| URL | http://testphp.vulnweb.com |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 238 bytes. |
GET http://testphp.vulnweb.com HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:51:59 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/AJAX/index.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/AJAX/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4236 |
| Response Body - size: 4,236 bytes. |
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>ajax test</title> <link href="styles.css" rel="stylesheet" type="text/css" /> <script type="text/javascript"> var httpreq = null; function SetContent(XML) { var items = XML.getElementsByTagName('items').item(0).getElementsByTagName('item'); var inner = '<ul>'; for(i=0; i<items.length; i++){ inner = inner + '<li><a href="javascript:getInfo(\'' + items[i].attributes.item(0).value + '\', \'' + items[i].attributes.item(1).value + '\')">' + items[i].firstChild.nodeValue + '</a></li>'; } inner = inner + '</ul>' cd = document.getElementById('contentDiv'); cd.innerHTML = inner; id = document.getElementById('infoDiv'); id.innerHTML = ''; } function httpCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetContent(httpreq.responseXML); httpreq = null; } } function SetInfo(XML) { var ii = XML.getElementsByTagName('iteminfo').item(0); var inner = ''; inner = inner + '<p><strong>' + ii.getElementsByTagName('name').item(0).firstChild.nodeValue + '</strong></p>'; pict = ii.getElementsByTagName('picture'); if(pict.length>0){ inner = inner + '<img src="../showimage.php?file=' + pict.item(0).firstChild.nodeValue + '"/>'; } descs = ii.getElementsByTagName('description'); for (i=0; i<descs.length; i++){ inner = inner + '<p>' + descs.item(i).firstChild.nodeValue + '</p>'; } id = document.getElementById('infoDiv'); id.innerHTML = inner; } function httpInfoCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetInfo(httpreq.responseXML); httpreq = null; } } function loadSomething(what) { getHttpRequest(); httpreq.open('GET', what, true); httpreq.send(''); } function getInfo(where, which) { getHttpRequest(); httpreq.onreadystatechange = httpInfoCompleted; if (where=='infotitle'){ httpreq.open('POST', where+'.php', true); httpreq.setRequestHeader('content-type', 'application/x-www-form-urlencoded'); httpreq.send('id='+which); } else { httpreq.open('GET', where+'.php?id='+which, true); httpreq.send(''); } } function xmlCompleted () { if (httpreq.readyState==4 && httpreq.status==200) { xd = document.getElementById('xmlDiv'); xd.innerHTML = httpreq.responseText; httpreq = null; } } function sendXML () { getHttpRequest(); httpreq.onreadystatechange = xmlCompleted; httpreq.open('POST', 'showxml.php'); httpreq.setRequestHeader('content-type', 'text/xml'); httpreq.send('<xml><node name="nodename1">nodetext1</node><node name="nodename2">nodetext2</node></xml>'); } function getHttpRequest() { // free the curent one if (httpreq!=null){ httpreq.abort(); httpreq = null; } if( window.XMLHttpRequest ) { httpreq = new XMLHttpRequest(); if (httpreq.overrideMimeType) { httpreq.overrideMimeType('text/xml'); } } else if(ActiveXObject) { httpreq = new ActiveXObject("Msxml2.XMLHTTP"); } httpreq.onreadystatechange = httpCompleted; } function SetMyCookie() { document.cookie = "mycookie=3"; alert('A cookie was set by JavaScript.'); } </script> </head> <body> <table border="0" cellpadding="3" width="500" align="center"> <tr> <td class="bordered"> <a href="javascript:loadSomething('artists.php');">artists</a> | <a href="javascript:loadSomething('categories.php');">categories</a> | <a href="#" onclick="loadSomething('titles.php')">titles</a> | <a href="#" onclick="sendXML()">send xml</a> | <a href="#" onclick="SetMyCookie()">setcookie</a> </td> </tr> <tr> <td> <div id="contentDiv"> </div> </td> </tr> <tr> <td> <div id="infoDiv"> </div> </td> </tr> <tr> <td> <div id="xmlDiv"> </div> </td> </tr> </table> </body> </html> |
| URL | http://testphp.vulnweb.com/artists.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/artists.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5328 |
| Response Body - size: 5,328 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class='story'><a href='artists.php?artist=1'><h3>r4w8173</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=2'><h3>Blad3</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=3'><h3>lyzae</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6251 |
| Response Body - size: 6,251 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: r4w8173</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=1'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: Blad3</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=2'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: lyzae</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=3'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 284 bytes. |
GET http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/categories.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/categories.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6115 |
| Response Body - size: 6,115 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture categories</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">categories</h2> <div class='story'><a href='listproducts.php?cat=1'><h3>Posters</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=2'><h3>Paintings</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=3'><h3>Stickers</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=4'><h3>Graffity</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/disclaimer.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/disclaimer.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5524 |
| Response Body - size: 5,524 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>disclaimer</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">Disclaimer</h2> <div class="story"> <h6>Please read carefully</h6> <p>This website is created to demonstrate the abilities of Acunetix new product <strong>WEB Vulnerability Scanner</strong>.</p> It is not intended to be a real online shop. Also this website was constructed with common web programming errors so it is buggy. <p>Please do not post any confidential information on this site. Do not give any creditcard number or real address, nor e-mail or website addresses.</p> <p>Information you post on this site are by no means private nor protected!</p> <p>All images on this site were generated with fre software <a href="http://www.eclectasy.com/Fractal-Explorer/index.html" target="_blank"> <strong>Fractal Explorer</strong></a>.</p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5390 |
| Response Body - size: 5,390 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong></strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/high |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 280 bytes. |
GET http://testphp.vulnweb.com/high HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 259 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html Content-Length: 555 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 555 bytes. |
<html>
<head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> |
| URL | http://testphp.vulnweb.com/hpp/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 280 bytes. |
GET http://testphp.vulnweb.com/hpp/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 203 |
| Response Body - size: 203 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/?pp=12 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 291 bytes. |
GET http://testphp.vulnweb.com/hpp/?pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 383 |
| Response Body - size: 383 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <a href="params.php?p=valid&pp=12">link1</a><br/><a href="params.php?p=valid&pp=12">link2</a><br/><form action="params.php?p=valid&pp=12"><input type=submit name=aaaa/></form><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 315 bytes. |
GET http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/?pp=12 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 404 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7 |
| Response Body - size: 7 bytes. |
valid12
|
| URL | http://testphp.vulnweb.com/index.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7994 |
| Response Body - size: 7,994 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>r4w8173</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5193 |
| Response Body - size: 5,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Blad3</h2><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=3 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7880 |
| Response Body - size: 7,880 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Posters</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5311 |
| Response Body - size: 5,311 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Paintings</h2><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/login.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/login.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5523 |
| Response Body - size: 5,523 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>login page</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h3>If you are already registered please enter your login information below:</h3><br> <form name="loginform" method="post" action="userinfo.php"> <table cellpadding="4" cellspacing="1"> <tr><td>Username : </td><td><input name="uname" type="text" size="20" style="width:120px;"></td></tr> <tr><td>Password : </td><td><input name="pass" type="password" size="20" style="width:120px;"></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="login" style="width:75px;"></td></tr> </table> </form> </div> <div class="story"> <h3> You can also <a href="signup.php">signup here</a>.<br> Signup disabled. Please use the username <font color='red'>test</font> and the password <font color='red'>test</font>. </h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 293 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 975 |
| Response Body - size: 975 bytes. |
<html>
<div id="content"> <div class='product'><table><tr><td width='180px'><img src='images/1.jpg'></td><td width='400px'><a href='Details/network-attached-storage-dlink/1/'>Network Storage D-Link DNS-313 enclosure 1 x SATA</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/network-attached-storage-dlink/1/'>Price<br>359 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/2.jpg'></td><td width='400px'><a href='Details/web-camera-a4tech/2/'>Web Camera A4Tech PK-335E</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/web-camera-a4tech/2/'>Price<br>10 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/3.jpg'></td><td width='400px'><a href='Details/color-printer/3/'>Laser Color Printer HP LaserJet M551dn, A4</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/color-printer/3/'>Price<br>812 €</a></td></table></tr></div></div> </html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 365 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for buying <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for buying <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 348 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for buying <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 335 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 313 |
| Response Body - size: 313 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/3.jpg'><b>Laser Color Printer HP LaserJet M551dn, A4</b><br><br>Laser Color Printer HP LaserJet M551dn, A4<br><a href='/Mod_Rewrite_Shop/BuyProduct-3/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-3.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 319 |
| Response Body - size: 319 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/1.jpg'><b>Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br>NET STORAGE ENCLOSURE SATA DNS-313 D-LINK<br><a href='/Mod_Rewrite_Shop/BuyProduct-1/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-1.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 339 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 279 |
| Response Body - size: 279 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/2.jpg'><b>Web Camera A4Tech PK-335E</b><br><br>Web Camera A4Tech PK-335E<br><a href='/Mod_Rewrite_Shop/BuyProduct-2/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-2.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 370 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for rating <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 357 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for rating <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 353 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for rating <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/privacy.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/privacy.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 412 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 16 |
| Response Body - size: 16 bytes. |
File not found.
|
| URL | http://testphp.vulnweb.com/product.php?pic=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6428 |
| Response Body - size: 6,428 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The shore</h2><div class='story'><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $500</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='500'><input type='hidden' name='addcart' value='1'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6368 |
| Response Body - size: 6,368 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mistery</h2><div class='story'><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $800</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='800'><input type='hidden' name='addcart' value='2'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6401 |
| Response Body - size: 6,401 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The universe</h2><div class='story'><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $986</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='986'><input type='hidden' name='addcart' value='3'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6453 |
| Response Body - size: 6,453 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Walking</h2><div class='story'><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $1000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='1000'><input type='hidden' name='addcart' value='4'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=5 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=5 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6382 |
| Response Body - size: 6,382 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mean</h2><div class='story'><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $460</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='460'><input type='hidden' name='addcart' value='5'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=6 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=6 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6454 |
| Response Body - size: 6,454 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Thing</h2><div class='story'><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 99 cm x 200 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $10000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='10000'><input type='hidden' name='addcart' value='6'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=7 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=7 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5734 |
| Response Body - size: 5,734 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Trees</h2><div class='story'><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>bla bla bla</p><h3>Long description</h3><p>bla bla bla long</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p>the price of this item is: $15000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='15000'><input type='hidden' name='addcart' value='7'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/robots.txt |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 249 bytes. |
GET http://testphp.vulnweb.com/robots.txt HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 259 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html Content-Length: 555 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 555 bytes. |
<html>
<head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> |
| URL | http://testphp.vulnweb.com/signup.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 296 bytes. |
GET http://testphp.vulnweb.com/signup.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/login.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6033 |
| Response Body - size: 6,033 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>signup</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h2 id="pageName">Signup new user</h2> <h4>Please do not enter real information here.</h4> <h4>If you press the submit button you will be transferred to asecured connection.</h4> <form name="form1" method="post" action="/secured/newuser.php"> <table border="0" cellspacing="1" cellpadding="4"> <tr><td valign="top">Username:</td><td><input type="text" name="uuname" style="width:200px"></td></tr> <tr><td valign="top">Password:</td><td><input type="password" name="upass" style="width:200px"></td></tr> <tr><td valign="top">Retype password:</td><td><input type="password" name="upass2" style="width:200px"></td></tr> <tr><td valign="top">Name:</td><td><input type="text" name="urname" style="width:200px"></td></tr> <tr><td valign="top">Credit card number:</td><td><input type="text" name="ucc" style="width:200px"></td></tr> <tr><td valign="top">E-Mail:</td><td><input type="text" name="uemail" style="width:200px"></td></tr> <tr><td valign="top">Phone number:</td><td><input type="text" name="uphone" style="width:200px"></td></tr> <tr><td valign="top">Address:</td><td><textarea wrap="soft" name="uaddress" rows="5" style="width:200px"></textarea></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="signup" name="signup"></td></tr> </table> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/sitemap.xml |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 250 bytes. |
GET http://testphp.vulnweb.com/sitemap.xml HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 259 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html Content-Length: 555 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 555 bytes. |
<html>
<head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 372 bytes. |
POST http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/product.php?pic=1 content-length: 19 |
| Request Body - size: 19 bytes. |
price=500&addcart=1
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 373 bytes. |
POST http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/guestbook.php content-length: 33 |
| Request Body - size: 33 bytes. |
name=ZAP&text=&submit=add+message
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5393 |
| Response Body - size: 5,393 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong>ZAP</strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/search.php?test=query |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 367 bytes. |
POST http://testphp.vulnweb.com/search.php?test=query HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com content-length: 25 |
| Request Body - size: 25 bytes. |
searchFor=ZAP&goButton=go
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4772 |
| Response Body - size: 4,772 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>search</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>searched for: ZAP</h2></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/secured/newuser.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | |
| Request Header - size: 376 bytes. |
POST http://testphp.vulnweb.com/secured/newuser.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/signup.php content-length: 96 |
| Request Body - size: 96 bytes. |
uuname=ZAP&upass=ZAP&upass2=ZAP&urname=ZAP&ucc=ZAP&uemail=ZAP&uphone=ZAP&uaddress=&signup=signup
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 733 |
| Response Body - size: 733 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html> <head> <title>add new user</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <link href="style.css" rel="stylesheet" type="text/css"> </head> <body> <div id="masthead"> <h1 id="siteName">ACUNETIX ART</h1> </div> <div id="content"> <p>You have been introduced to our database with the above informations:</p><ul><li>Username: ZAP</li><li>Password: ZAP</li><li>Name: ZAP</li><li>Address: </li><li>E-Mail: ZAP</li><li>Phone number: ZAP</li><li>Credit card: ZAP</li></ul><p>Now you can login from <a href='http://testphp.vulnweb.com/login.php'>here.</p></div> </body> </html> |
| Instances | 48 |
| Solution |
Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
|
| Reference |
https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy
https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html https://www.w3.org/TR/CSP/ https://w3c.github.io/webappsec-csp/ https://web.dev/articles/csp https://caniuse.com/#feat=contentsecuritypolicy https://content-security-policy.com/ |
| Tags |
CWE-693
OWASP_2021_A05 OWASP_2017_A06 |
| CWE Id | 693 |
| WASC Id | 15 |
| Plugin Id | 10038 |
|
Medium |
Missing Anti-clickjacking Header |
|---|---|
| Description |
The response does not protect against 'ClickJacking' attacks. It should include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options.
|
| URL | http://testphp.vulnweb.com |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 238 bytes. |
GET http://testphp.vulnweb.com HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:51:59 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/AJAX/index.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/AJAX/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4236 |
| Response Body - size: 4,236 bytes. |
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>ajax test</title> <link href="styles.css" rel="stylesheet" type="text/css" /> <script type="text/javascript"> var httpreq = null; function SetContent(XML) { var items = XML.getElementsByTagName('items').item(0).getElementsByTagName('item'); var inner = '<ul>'; for(i=0; i<items.length; i++){ inner = inner + '<li><a href="javascript:getInfo(\'' + items[i].attributes.item(0).value + '\', \'' + items[i].attributes.item(1).value + '\')">' + items[i].firstChild.nodeValue + '</a></li>'; } inner = inner + '</ul>' cd = document.getElementById('contentDiv'); cd.innerHTML = inner; id = document.getElementById('infoDiv'); id.innerHTML = ''; } function httpCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetContent(httpreq.responseXML); httpreq = null; } } function SetInfo(XML) { var ii = XML.getElementsByTagName('iteminfo').item(0); var inner = ''; inner = inner + '<p><strong>' + ii.getElementsByTagName('name').item(0).firstChild.nodeValue + '</strong></p>'; pict = ii.getElementsByTagName('picture'); if(pict.length>0){ inner = inner + '<img src="../showimage.php?file=' + pict.item(0).firstChild.nodeValue + '"/>'; } descs = ii.getElementsByTagName('description'); for (i=0; i<descs.length; i++){ inner = inner + '<p>' + descs.item(i).firstChild.nodeValue + '</p>'; } id = document.getElementById('infoDiv'); id.innerHTML = inner; } function httpInfoCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetInfo(httpreq.responseXML); httpreq = null; } } function loadSomething(what) { getHttpRequest(); httpreq.open('GET', what, true); httpreq.send(''); } function getInfo(where, which) { getHttpRequest(); httpreq.onreadystatechange = httpInfoCompleted; if (where=='infotitle'){ httpreq.open('POST', where+'.php', true); httpreq.setRequestHeader('content-type', 'application/x-www-form-urlencoded'); httpreq.send('id='+which); } else { httpreq.open('GET', where+'.php?id='+which, true); httpreq.send(''); } } function xmlCompleted () { if (httpreq.readyState==4 && httpreq.status==200) { xd = document.getElementById('xmlDiv'); xd.innerHTML = httpreq.responseText; httpreq = null; } } function sendXML () { getHttpRequest(); httpreq.onreadystatechange = xmlCompleted; httpreq.open('POST', 'showxml.php'); httpreq.setRequestHeader('content-type', 'text/xml'); httpreq.send('<xml><node name="nodename1">nodetext1</node><node name="nodename2">nodetext2</node></xml>'); } function getHttpRequest() { // free the curent one if (httpreq!=null){ httpreq.abort(); httpreq = null; } if( window.XMLHttpRequest ) { httpreq = new XMLHttpRequest(); if (httpreq.overrideMimeType) { httpreq.overrideMimeType('text/xml'); } } else if(ActiveXObject) { httpreq = new ActiveXObject("Msxml2.XMLHTTP"); } httpreq.onreadystatechange = httpCompleted; } function SetMyCookie() { document.cookie = "mycookie=3"; alert('A cookie was set by JavaScript.'); } </script> </head> <body> <table border="0" cellpadding="3" width="500" align="center"> <tr> <td class="bordered"> <a href="javascript:loadSomething('artists.php');">artists</a> | <a href="javascript:loadSomething('categories.php');">categories</a> | <a href="#" onclick="loadSomething('titles.php')">titles</a> | <a href="#" onclick="sendXML()">send xml</a> | <a href="#" onclick="SetMyCookie()">setcookie</a> </td> </tr> <tr> <td> <div id="contentDiv"> </div> </td> </tr> <tr> <td> <div id="infoDiv"> </div> </td> </tr> <tr> <td> <div id="xmlDiv"> </div> </td> </tr> </table> </body> </html> |
| URL | http://testphp.vulnweb.com/artists.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/artists.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5328 |
| Response Body - size: 5,328 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class='story'><a href='artists.php?artist=1'><h3>r4w8173</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=2'><h3>Blad3</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=3'><h3>lyzae</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=1 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6251 |
| Response Body - size: 6,251 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: r4w8173</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=1'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=2 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: Blad3</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=2'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=3 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: lyzae</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=3'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 284 bytes. |
GET http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/categories.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/categories.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6115 |
| Response Body - size: 6,115 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture categories</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">categories</h2> <div class='story'><a href='listproducts.php?cat=1'><h3>Posters</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=2'><h3>Paintings</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=3'><h3>Stickers</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=4'><h3>Graffity</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/disclaimer.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/disclaimer.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5524 |
| Response Body - size: 5,524 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>disclaimer</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">Disclaimer</h2> <div class="story"> <h6>Please read carefully</h6> <p>This website is created to demonstrate the abilities of Acunetix new product <strong>WEB Vulnerability Scanner</strong>.</p> It is not intended to be a real online shop. Also this website was constructed with common web programming errors so it is buggy. <p>Please do not post any confidential information on this site. Do not give any creditcard number or real address, nor e-mail or website addresses.</p> <p>Information you post on this site are by no means private nor protected!</p> <p>All images on this site were generated with fre software <a href="http://www.eclectasy.com/Fractal-Explorer/index.html" target="_blank"> <strong>Fractal Explorer</strong></a>.</p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5390 |
| Response Body - size: 5,390 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong></strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/hpp/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 280 bytes. |
GET http://testphp.vulnweb.com/hpp/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 203 |
| Response Body - size: 203 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/?pp=12 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 291 bytes. |
GET http://testphp.vulnweb.com/hpp/?pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 383 |
| Response Body - size: 383 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <a href="params.php?p=valid&pp=12">link1</a><br/><a href="params.php?p=valid&pp=12">link2</a><br/><form action="params.php?p=valid&pp=12"><input type=submit name=aaaa/></form><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 315 bytes. |
GET http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/?pp=12 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 404 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7 |
| Response Body - size: 7 bytes. |
valid12
|
| URL | http://testphp.vulnweb.com/index.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=1 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7994 |
| Response Body - size: 7,994 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>r4w8173</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=2 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5193 |
| Response Body - size: 5,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Blad3</h2><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=3 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=3 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7880 |
| Response Body - size: 7,880 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Posters</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5311 |
| Response Body - size: 5,311 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Paintings</h2><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=3 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=4 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/login.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/login.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5523 |
| Response Body - size: 5,523 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>login page</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h3>If you are already registered please enter your login information below:</h3><br> <form name="loginform" method="post" action="userinfo.php"> <table cellpadding="4" cellspacing="1"> <tr><td>Username : </td><td><input name="uname" type="text" size="20" style="width:120px;"></td></tr> <tr><td>Password : </td><td><input name="pass" type="password" size="20" style="width:120px;"></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="login" style="width:75px;"></td></tr> </table> </form> </div> <div class="story"> <h3> You can also <a href="signup.php">signup here</a>.<br> Signup disabled. Please use the username <font color='red'>test</font> and the password <font color='red'>test</font>. </h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 293 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 975 |
| Response Body - size: 975 bytes. |
<html>
<div id="content"> <div class='product'><table><tr><td width='180px'><img src='images/1.jpg'></td><td width='400px'><a href='Details/network-attached-storage-dlink/1/'>Network Storage D-Link DNS-313 enclosure 1 x SATA</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/network-attached-storage-dlink/1/'>Price<br>359 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/2.jpg'></td><td width='400px'><a href='Details/web-camera-a4tech/2/'>Web Camera A4Tech PK-335E</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/web-camera-a4tech/2/'>Price<br>10 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/3.jpg'></td><td width='400px'><a href='Details/color-printer/3/'>Laser Color Printer HP LaserJet M551dn, A4</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/color-printer/3/'>Price<br>812 €</a></td></table></tr></div></div> </html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 365 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for buying <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for buying <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 348 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for buying <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 335 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 313 |
| Response Body - size: 313 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/3.jpg'><b>Laser Color Printer HP LaserJet M551dn, A4</b><br><br>Laser Color Printer HP LaserJet M551dn, A4<br><a href='/Mod_Rewrite_Shop/BuyProduct-3/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-3.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 319 |
| Response Body - size: 319 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/1.jpg'><b>Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br>NET STORAGE ENCLOSURE SATA DNS-313 D-LINK<br><a href='/Mod_Rewrite_Shop/BuyProduct-1/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-1.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 339 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 279 |
| Response Body - size: 279 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/2.jpg'><b>Web Camera A4Tech PK-335E</b><br><br>Web Camera A4Tech PK-335E<br><a href='/Mod_Rewrite_Shop/BuyProduct-2/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-2.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 370 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for rating <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 357 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for rating <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 353 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for rating <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/product.php?pic=1 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6428 |
| Response Body - size: 6,428 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The shore</h2><div class='story'><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $500</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='500'><input type='hidden' name='addcart' value='1'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=2 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6368 |
| Response Body - size: 6,368 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mistery</h2><div class='story'><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $800</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='800'><input type='hidden' name='addcart' value='2'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=3 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6401 |
| Response Body - size: 6,401 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The universe</h2><div class='story'><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $986</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='986'><input type='hidden' name='addcart' value='3'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=4 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6453 |
| Response Body - size: 6,453 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Walking</h2><div class='story'><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $1000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='1000'><input type='hidden' name='addcart' value='4'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=5 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=5 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6382 |
| Response Body - size: 6,382 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mean</h2><div class='story'><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $460</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='460'><input type='hidden' name='addcart' value='5'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=6 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=6 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6454 |
| Response Body - size: 6,454 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Thing</h2><div class='story'><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 99 cm x 200 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $10000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='10000'><input type='hidden' name='addcart' value='6'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=7 |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=7 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5734 |
| Response Body - size: 5,734 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Trees</h2><div class='story'><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>bla bla bla</p><h3>Long description</h3><p>bla bla bla long</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p>the price of this item is: $15000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='15000'><input type='hidden' name='addcart' value='7'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/signup.php |
| Method | GET |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 296 bytes. |
GET http://testphp.vulnweb.com/signup.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/login.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6033 |
| Response Body - size: 6,033 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>signup</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h2 id="pageName">Signup new user</h2> <h4>Please do not enter real information here.</h4> <h4>If you press the submit button you will be transferred to asecured connection.</h4> <form name="form1" method="post" action="/secured/newuser.php"> <table border="0" cellspacing="1" cellpadding="4"> <tr><td valign="top">Username:</td><td><input type="text" name="uuname" style="width:200px"></td></tr> <tr><td valign="top">Password:</td><td><input type="password" name="upass" style="width:200px"></td></tr> <tr><td valign="top">Retype password:</td><td><input type="password" name="upass2" style="width:200px"></td></tr> <tr><td valign="top">Name:</td><td><input type="text" name="urname" style="width:200px"></td></tr> <tr><td valign="top">Credit card number:</td><td><input type="text" name="ucc" style="width:200px"></td></tr> <tr><td valign="top">E-Mail:</td><td><input type="text" name="uemail" style="width:200px"></td></tr> <tr><td valign="top">Phone number:</td><td><input type="text" name="uphone" style="width:200px"></td></tr> <tr><td valign="top">Address:</td><td><textarea wrap="soft" name="uaddress" rows="5" style="width:200px"></textarea></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="signup" name="signup"></td></tr> </table> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | POST |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 372 bytes. |
POST http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/product.php?pic=1 content-length: 19 |
| Request Body - size: 19 bytes. |
price=500&addcart=1
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | POST |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 373 bytes. |
POST http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/guestbook.php content-length: 33 |
| Request Body - size: 33 bytes. |
name=ZAP&text=&submit=add+message
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5393 |
| Response Body - size: 5,393 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong>ZAP</strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/search.php?test=query |
| Method | POST |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 367 bytes. |
POST http://testphp.vulnweb.com/search.php?test=query HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com content-length: 25 |
| Request Body - size: 25 bytes. |
searchFor=ZAP&goButton=go
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4772 |
| Response Body - size: 4,772 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>search</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>searched for: ZAP</h2></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/secured/newuser.php |
| Method | POST |
| Parameter | x-frame-options |
| Attack | |
| Evidence | |
| Request Header - size: 376 bytes. |
POST http://testphp.vulnweb.com/secured/newuser.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/signup.php content-length: 96 |
| Request Body - size: 96 bytes. |
uuname=ZAP&upass=ZAP&upass2=ZAP&urname=ZAP&ucc=ZAP&uemail=ZAP&uphone=ZAP&uaddress=&signup=signup
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 733 |
| Response Body - size: 733 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html> <head> <title>add new user</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <link href="style.css" rel="stylesheet" type="text/css"> </head> <body> <div id="masthead"> <h1 id="siteName">ACUNETIX ART</h1> </div> <div id="content"> <p>You have been introduced to our database with the above informations:</p><ul><li>Username: ZAP</li><li>Password: ZAP</li><li>Name: ZAP</li><li>Address: </li><li>E-Mail: ZAP</li><li>Phone number: ZAP</li><li>Credit card: ZAP</li></ul><p>Now you can login from <a href='http://testphp.vulnweb.com/login.php'>here.</p></div> </body> </html> |
| Instances | 44 |
| Solution |
Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.
If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive.
|
| Reference | https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options |
| Tags |
WSTG-v42-CLNT-09
OWASP_2021_A05 OWASP_2017_A06 CWE-1021 |
| CWE Id | 1021 |
| WASC Id | 15 |
| Plugin Id | 10020 |
|
Low |
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) |
|---|---|
| Description |
The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.
|
| URL | http://testphp.vulnweb.com |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 238 bytes. |
GET http://testphp.vulnweb.com HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:51:59 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/AJAX/index.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/AJAX/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4236 |
| Response Body - size: 4,236 bytes. |
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>ajax test</title> <link href="styles.css" rel="stylesheet" type="text/css" /> <script type="text/javascript"> var httpreq = null; function SetContent(XML) { var items = XML.getElementsByTagName('items').item(0).getElementsByTagName('item'); var inner = '<ul>'; for(i=0; i<items.length; i++){ inner = inner + '<li><a href="javascript:getInfo(\'' + items[i].attributes.item(0).value + '\', \'' + items[i].attributes.item(1).value + '\')">' + items[i].firstChild.nodeValue + '</a></li>'; } inner = inner + '</ul>' cd = document.getElementById('contentDiv'); cd.innerHTML = inner; id = document.getElementById('infoDiv'); id.innerHTML = ''; } function httpCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetContent(httpreq.responseXML); httpreq = null; } } function SetInfo(XML) { var ii = XML.getElementsByTagName('iteminfo').item(0); var inner = ''; inner = inner + '<p><strong>' + ii.getElementsByTagName('name').item(0).firstChild.nodeValue + '</strong></p>'; pict = ii.getElementsByTagName('picture'); if(pict.length>0){ inner = inner + '<img src="../showimage.php?file=' + pict.item(0).firstChild.nodeValue + '"/>'; } descs = ii.getElementsByTagName('description'); for (i=0; i<descs.length; i++){ inner = inner + '<p>' + descs.item(i).firstChild.nodeValue + '</p>'; } id = document.getElementById('infoDiv'); id.innerHTML = inner; } function httpInfoCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetInfo(httpreq.responseXML); httpreq = null; } } function loadSomething(what) { getHttpRequest(); httpreq.open('GET', what, true); httpreq.send(''); } function getInfo(where, which) { getHttpRequest(); httpreq.onreadystatechange = httpInfoCompleted; if (where=='infotitle'){ httpreq.open('POST', where+'.php', true); httpreq.setRequestHeader('content-type', 'application/x-www-form-urlencoded'); httpreq.send('id='+which); } else { httpreq.open('GET', where+'.php?id='+which, true); httpreq.send(''); } } function xmlCompleted () { if (httpreq.readyState==4 && httpreq.status==200) { xd = document.getElementById('xmlDiv'); xd.innerHTML = httpreq.responseText; httpreq = null; } } function sendXML () { getHttpRequest(); httpreq.onreadystatechange = xmlCompleted; httpreq.open('POST', 'showxml.php'); httpreq.setRequestHeader('content-type', 'text/xml'); httpreq.send('<xml><node name="nodename1">nodetext1</node><node name="nodename2">nodetext2</node></xml>'); } function getHttpRequest() { // free the curent one if (httpreq!=null){ httpreq.abort(); httpreq = null; } if( window.XMLHttpRequest ) { httpreq = new XMLHttpRequest(); if (httpreq.overrideMimeType) { httpreq.overrideMimeType('text/xml'); } } else if(ActiveXObject) { httpreq = new ActiveXObject("Msxml2.XMLHTTP"); } httpreq.onreadystatechange = httpCompleted; } function SetMyCookie() { document.cookie = "mycookie=3"; alert('A cookie was set by JavaScript.'); } </script> </head> <body> <table border="0" cellpadding="3" width="500" align="center"> <tr> <td class="bordered"> <a href="javascript:loadSomething('artists.php');">artists</a> | <a href="javascript:loadSomething('categories.php');">categories</a> | <a href="#" onclick="loadSomething('titles.php')">titles</a> | <a href="#" onclick="sendXML()">send xml</a> | <a href="#" onclick="SetMyCookie()">setcookie</a> </td> </tr> <tr> <td> <div id="contentDiv"> </div> </td> </tr> <tr> <td> <div id="infoDiv"> </div> </td> </tr> <tr> <td> <div id="xmlDiv"> </div> </td> </tr> </table> </body> </html> |
| URL | http://testphp.vulnweb.com/artists.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/artists.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5328 |
| Response Body - size: 5,328 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class='story'><a href='artists.php?artist=1'><h3>r4w8173</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=2'><h3>Blad3</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=3'><h3>lyzae</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6251 |
| Response Body - size: 6,251 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: r4w8173</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=1'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: Blad3</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=2'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: lyzae</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=3'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 284 bytes. |
GET http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/categories.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/categories.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6115 |
| Response Body - size: 6,115 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture categories</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">categories</h2> <div class='story'><a href='listproducts.php?cat=1'><h3>Posters</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=2'><h3>Paintings</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=3'><h3>Stickers</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=4'><h3>Graffity</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/disclaimer.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/disclaimer.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5524 |
| Response Body - size: 5,524 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>disclaimer</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">Disclaimer</h2> <div class="story"> <h6>Please read carefully</h6> <p>This website is created to demonstrate the abilities of Acunetix new product <strong>WEB Vulnerability Scanner</strong>.</p> It is not intended to be a real online shop. Also this website was constructed with common web programming errors so it is buggy. <p>Please do not post any confidential information on this site. Do not give any creditcard number or real address, nor e-mail or website addresses.</p> <p>Information you post on this site are by no means private nor protected!</p> <p>All images on this site were generated with fre software <a href="http://www.eclectasy.com/Fractal-Explorer/index.html" target="_blank"> <strong>Fractal Explorer</strong></a>.</p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5390 |
| Response Body - size: 5,390 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong></strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/hpp/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 280 bytes. |
GET http://testphp.vulnweb.com/hpp/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 203 |
| Response Body - size: 203 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/?pp=12 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 291 bytes. |
GET http://testphp.vulnweb.com/hpp/?pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 383 |
| Response Body - size: 383 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <a href="params.php?p=valid&pp=12">link1</a><br/><a href="params.php?p=valid&pp=12">link2</a><br/><form action="params.php?p=valid&pp=12"><input type=submit name=aaaa/></form><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 315 bytes. |
GET http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/?pp=12 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 404 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7 |
| Response Body - size: 7 bytes. |
valid12
|
| URL | http://testphp.vulnweb.com/index.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7994 |
| Response Body - size: 7,994 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>r4w8173</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5193 |
| Response Body - size: 5,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Blad3</h2><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=3 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7880 |
| Response Body - size: 7,880 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Posters</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5311 |
| Response Body - size: 5,311 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Paintings</h2><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/login.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/login.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5523 |
| Response Body - size: 5,523 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>login page</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h3>If you are already registered please enter your login information below:</h3><br> <form name="loginform" method="post" action="userinfo.php"> <table cellpadding="4" cellspacing="1"> <tr><td>Username : </td><td><input name="uname" type="text" size="20" style="width:120px;"></td></tr> <tr><td>Password : </td><td><input name="pass" type="password" size="20" style="width:120px;"></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="login" style="width:75px;"></td></tr> </table> </form> </div> <div class="story"> <h3> You can also <a href="signup.php">signup here</a>.<br> Signup disabled. Please use the username <font color='red'>test</font> and the password <font color='red'>test</font>. </h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 293 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 975 |
| Response Body - size: 975 bytes. |
<html>
<div id="content"> <div class='product'><table><tr><td width='180px'><img src='images/1.jpg'></td><td width='400px'><a href='Details/network-attached-storage-dlink/1/'>Network Storage D-Link DNS-313 enclosure 1 x SATA</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/network-attached-storage-dlink/1/'>Price<br>359 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/2.jpg'></td><td width='400px'><a href='Details/web-camera-a4tech/2/'>Web Camera A4Tech PK-335E</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/web-camera-a4tech/2/'>Price<br>10 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/3.jpg'></td><td width='400px'><a href='Details/color-printer/3/'>Laser Color Printer HP LaserJet M551dn, A4</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/color-printer/3/'>Price<br>812 €</a></td></table></tr></div></div> </html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 365 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for buying <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for buying <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 348 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for buying <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 335 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 313 |
| Response Body - size: 313 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/3.jpg'><b>Laser Color Printer HP LaserJet M551dn, A4</b><br><br>Laser Color Printer HP LaserJet M551dn, A4<br><a href='/Mod_Rewrite_Shop/BuyProduct-3/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-3.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 319 |
| Response Body - size: 319 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/1.jpg'><b>Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br>NET STORAGE ENCLOSURE SATA DNS-313 D-LINK<br><a href='/Mod_Rewrite_Shop/BuyProduct-1/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-1.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 339 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 279 |
| Response Body - size: 279 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/2.jpg'><b>Web Camera A4Tech PK-335E</b><br><br>Web Camera A4Tech PK-335E<br><a href='/Mod_Rewrite_Shop/BuyProduct-2/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-2.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 370 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for rating <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 357 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for rating <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 353 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for rating <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/privacy.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/privacy.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 412 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 16 |
| Response Body - size: 16 bytes. |
File not found.
|
| URL | http://testphp.vulnweb.com/product.php?pic=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6428 |
| Response Body - size: 6,428 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The shore</h2><div class='story'><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $500</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='500'><input type='hidden' name='addcart' value='1'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6368 |
| Response Body - size: 6,368 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mistery</h2><div class='story'><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $800</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='800'><input type='hidden' name='addcart' value='2'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6401 |
| Response Body - size: 6,401 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The universe</h2><div class='story'><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $986</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='986'><input type='hidden' name='addcart' value='3'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6453 |
| Response Body - size: 6,453 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Walking</h2><div class='story'><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $1000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='1000'><input type='hidden' name='addcart' value='4'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=5 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=5 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6382 |
| Response Body - size: 6,382 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mean</h2><div class='story'><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $460</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='460'><input type='hidden' name='addcart' value='5'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=6 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=6 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6454 |
| Response Body - size: 6,454 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Thing</h2><div class='story'><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 99 cm x 200 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $10000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='10000'><input type='hidden' name='addcart' value='6'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=7 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=7 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5734 |
| Response Body - size: 5,734 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Trees</h2><div class='story'><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>bla bla bla</p><h3>Long description</h3><p>bla bla bla long</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p>the price of this item is: $15000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='15000'><input type='hidden' name='addcart' value='7'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/showimage.php?file='%20+%20pict.item(0).firstChild.nodeValue%20+%20' |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 359 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file='%20+%20pict.item(0).firstChild.nodeValue%20+%20' HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/AJAX/index.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 392 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 261 |
| Response Body - size: 261 bytes. |
Warning: fopen(' pict.item(0).firstChild.nodeValue '): failed to open stream: No such file or directory in /hj/var/www/showimage.php on line 13
Warning: fpassthru() expects parameter 1 to be resource, boolean given in /hj/var/www/showimage.php on line 19 |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 12426 |
| Response Body - size: 12,426 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ù¬ÄìóÛÏ»)¡¢Øéʧç¢Úêôã,y3e®êÀ &ùcÑ[Kôá¶Z8Û! }cÕêóèÝ$óPLeí0¯ ô3]Gª¦¼ûåëÏqµÅU¼$ÅA1 LNù)öUvèÁ÷ôÜ*Umðwk¶«"$ Ëm6äg©> ô:ÛÄ`bj3ÝOIÄI,D LMNû553ëOW 1ñ¾c?¨KéÀÒ "ÓvÊßdyó-<Ò¡Ç2Õ ½M!²Ç]'Ùêìvj²b 4Æi{tøj(Ñ_¥\Ù_ÐÆxï 0çM¦Þ¥ØcÇ t1Saè6ù¦xµ5Ó¹ÝÕoô¨°Á˵ÝmÖÚ<É«- ÇVjrvký¸oò]lÅ]Ñn.ÑM7×ÚVu}ðqÚùæfÀÉ^A£>Úi¹MzK0äç_dïÏx4ñ7¨ÁíÌ¡ô¹öåcZj»²¸ì"fN«²V²½¬6Fâ¯-AFÜ~ÌÕ]¼GaÕrH"H*H9gMÌÒz|¶Å)8Öפw¹¹o:xÔ9}2_D_GËuºÍ±\ötXã#W»:ãæmbg*¾®3ólnWdÞ&Í *zäÑëtEÙ3Ù³?D§§¼\÷ϤéSo&¹¾ôÞmN?C×I\,ë(ë¹é:|NkÈ㿲'ÕÛ K]¤ßÎù 9P ° ¢`Ó¸I¶¢½FõE³Lê7Ýçubú§/µ¦rs´tÎ4GO ÍÚ(Ó͵î¹ù=fÛOÖçF½Z|ÚÈlë ùñÞ T4LHÔñÕo]ØߥVËèVf2{/=q ³&ÀÓ5}OYÓ_;ÅÜUÙ , &&*@Ð:î»»¯²Îë°²ê,4ßA¯V]~mYÖm/uSzÿ £i}yÓkçÐ ÄM hu XvI=óa6òÖ\1ÌtÓ»>~£qbÜa·ßíë?ÊéR÷J¾§<µé¯´óày´@ PD jlØ ®NC¬ëpbØÄ0ÑHyõ²ùúЬ>3Ú ¼±ãôë{sÕ! ÿÄ ( !"01@$#23ÿÚ £ÍÜÀ¦7b 0ÿ ·Í4¹Úºµ°°E2« (ê tW.Vê×Ó »½Ýª¶£óÿ ´lM_äºßÊD ±P8ïùR,ZU»Î[íÓGæ®Hmö¼E°£;ìÄö¸Z©[õJ[ªo¦ÁOXÿ ß%G@eo´Ú~ÚBF»^^ËÊØy^V¹0÷;áàq¸ö ë¹n6\§µgúÚdÕÇ[v ~ÇU©o^N¤Ù¡î¹°l¼3)¸¤[°«z0ZÇGto¿uf$ÒA±0<c¥_RÛXTºfBÐ"ÊjÄÿ ê6 !ô©} < ]RÃJNkmgÑULëÇ_{Ø%{J.ñÓÒ ÕÄZË|ÓVî?XPé]-[ìzXQ?@_Æ¢ç,ÙßÓ k½Ãt¿k(VZîÃ0ù [}u¡bÜr°PÒvñ«ã3ÝâûK©ú(!_£Ëë{ÜæfQMj´-eõjʱô=rÑÓÿ 8ùt*;ª°¬«w[Ôº ib/O¼B!¡zMùìA~;©HqjÜÊOÈ(%NÙÉ9²e5`rlË8ËQP(êqðê-õnÑ*BÒ®>°Y¬°ÓäN·«v«{-3 nÚдâSÖTô[£¤U ^UbkªÒWÍU ¿÷=ÂqíöXÍgäÃß@böÚj¿«/g}¼¢E^ÍÉ`§9µE +!ñµY* Ú<Ü WKjåMj¡Ãu6tá>{賦åö4RδzÖ. N·îc©¼¼hf&!\w ÆRa(®'"ÜÃØö,᢬½ Î7±ÈtmÑ© &µéqjËòðlÄÄÇÏ@PU,E´&¨¶ÖìX`üb&AúÄ®¥µVÁXºíæg ûãDs]¤¼hõ+)FéÐVµu,zóe¨¢¢>VR"زÆ5³r_óñN6é%öQoGs!\ÅòxßèÇÈ3Y±«Âó(å--~KïøbÔ ½e«°'ãJ¯Ûm[qdäLÌÅ¿ÓgXÙbD´fYYøþö¦YP(þºÒ´ âéð©ú)n+ÏÈù¢ºÕ·{¿ç]¢)[&èÂÕSb CùÖ¬ Z§ä Æ`uÛ·*ÈÊZ±[ñÓ$ÛN&DUdÓZõÉéx+ÓPK5|u²uýAÌVÁÛ32¯,ṉÈöÄ--x]YuléRJ¶&Â±× OÓ ÌÄbhfk¦ÊÄBâ;æm,»`OêØ +BÑY@E3ýË cC ?° T1WÖ¼#Tc{ÊÖ«I)´j?¶'Q¥õ2_(}m+£;ͳó²G¿Yä0ÁÄu×ô꨼«Z0ÁÇÅõ'KVZõf U+Éó ÛllÅlEaãÊÈÃÊYÈ ÿ ÿÄ ! 01@A !PQqÿÚ ?zåWÄ!Ü~£¸ÕnDd%L@ëÕUÌATHÉ#_GBâ`oA9ÑH¤Hï÷NTG!àÿÄ + !1 A"02#3@BQaqðÿÚ ?²¯BDÖÄ Öè3 ö»@ `Ƭ5¸ªÞ×tpÂsÃPîZ OÆÈqâ §LLÅÛ¤hç!Á1ùsé5ù <s©1¸ðFá2KåZש{Òºc% xBýê@¿Zr} dóADÒëMx9¡Ü§ Oð¹Pâ1;&?»PúZµ_¤#ÙH]tâ Å dÿ 6Ið"ö_¨¸xä¯^TÄZYr1²YÚù(äp³JõÔ)G¼ø&c_ "2; ()l¸£ÀñÊ=GÇ'²ßnBؽ&1üé#\';Ð6èXm²¾ÏGǹ )ýQ`§r£:40ò n FPê¯ OÙ[PQ³Ò§kݲlO<T=QoóËLáÖ¥ë+ðPÛwEÓ3þwÆÑNF3YÒéÙÛñ@ >ÒhZk Ôu4h.˺N¥¹ ;V¡¸Ü¾·<ÝÍ$8´÷oûL²àòóet¬n9iÔ´fJé ÅDòéÜ¥ÿÄ 5 !1"A Qa02q@¡ð#BR±$3PÁbÑñÿÚ ?`'7,©, Db×lã !À Lùô*x¢ ê tÝ-®å5¬ÝC¢ChÙé·§#ø (gæ YÖÂúØVÈXÛ ´áTçµWÙuÓ;&0tO1o¨B{ôEÜ!}ð®ÀÑÃR»ê«çKͶ=¢&C5²Õe]½VþA 7Q4Ý7¶È½ÆGeADàplÀ}Ô7Ò6Yo·ÀFØÖMù*fͼªsé) »·¥°1~«ùUmzz@ Ðê«ð`(ájC-A_nª ¤ ,8ÙPHØ"î ½þae-»B´2ýL)/Y¨D* ;vòK¥C¥ÚpÊD â.}Í{yÒ º,7P\á h²*Hò§4\Á.?E' ]Tä"Ý0 q:z "¸ThKã(DswòèQºÅ;?nò ¼H¥º ªâcÕÕN£@³WeUP[ß Ð²ÊÐGUNA;óÐDºÈiB.ײÒkEI(=ßMùOF¡J¢à wB£éÍD wYFÄÀQva9Ä*-MHH üæ6C>ê²7\Ä«¢Ú¹½Óª5 =]w~SË1"Ûî³ô^¬ï0!xMv`îÔDþcæ·é¦ Z&êdy¤P¨vÀÈòZ*A*+8ÜVÁ Àè0 ÆnÊ%xfû{¦æVÐÔn¦þÑk½Â¤ùy`¬¶*]^ÊÈw·*Vfí*´D(BNÖUöó=Pø Ú>ÿ ñiÔ$üÑ@ø0ìôT0zcÿ éÈ5ÂxD$R&ÔÃþ]:)Øvh>\ÚÐÊÎ# æÍþKúpÑ·z(ËkBI lðæFÐK;ï @+ð©¬óõUôìU`# 9jí¬sIÜ(*¶älÀüy§QnÉ¥¦» !tSÞU0ùPíèØC>û#@TÍO=H2Aqý*->B'vÖÖYÌ9WHêJ&¥;;`{]ôV)¢ò©«" íJ¦Ìì´ ¸é2ª+('°øμÓYÝJ§¼¢ V$eÜo®_PDGítØo²Ãfë,Ô_±YÞðÓïÙ5º\rGn%¶ÔL*LtS5PØÉüá§êÀV¨Øa 4n\/K¨{FgöEærØþÕý× ÂÒêBým¾SúøÄ @w ¤´oh£·3¹Yx-êïËû§ ½*5ÍYíÑC 8D»ýÕpÜúØHTÒÙë4DíñÔÀNȹ³â8Ìfõæq dl ý¯p«mþ{å~ú§x¹L8åÓdÊíº¿ø<¤D(seÄsÈ©f}ð-ê³8ú¿ÏùG¿DNßRáq6#uxyræ«t äAtcpi0ziú¦°êâpÌÇê¥Ô4ý~ûã_1Z¨"g Xlp¶YÀ¶©9Nè`ýýº£ Æð»b&]a1)¾ ÃGpáÖñI6EÿÄ ) !1AQaqð @¡±0ÁÑáñÿÚ ?! LªûD¨}\ËÄϬu@ÙÌ·CEcÄDj9ñ®µ æó)h?[¿æ´ _m«Þlö>vtx:üøå tÛ0-e1UCLµô¶²xìídçYÌ7FMÛl¦zb ócÞTp»ÕP ©¡³¨gE£/#ÞV®ÕôýÁ´{O橸X<Ec.äLBç å *¥¥kLzFa © +xî/Ñ]ï=så pTÒ Ë #j¤¾9HÔt&Æ ÔʪîQÐv³C GæpAª´¢¼ÿ ³Æ.íÇMöwÔÐøUÄ $it¶% ç´©Û>!úXÖ' µI ªPû7N¼çæ m®åJÂظ`Öþkñ4úó/´Ø¬ ×õ)phÒ bæ3?`U¾ Ô!MëÀD«0 ù&jëe©º£ôáÑn0%$¸=¨H6Òá²cA·åÀ!à Ë~>T¯Â2¹Ù-7)W¬bGÆZ-kAÌlNÔÙoMçäþ¥t6pØWÎ(@BÈ45éßø¹ ÆàסXµ}=à>)»|bCöBTм_>Ñ°*¥ôò%Ê= æv«óqµÉ¦#§Hïë7 ©gµæcÐ rg'YÀ`ÕeÃþe,b¸.%x=QÀÛ ×ñæi´Üʸ zJ0À/l;èaÌ+Uu:é¸q .ÞëÚsÃqD\T9Ä_ÓÚôÅÜ=YDº.#£bùÍ£Füv; 2ÌòêfbªV¿;Aü5 +ÔÕOºµl<Ç¿HV,¤pé ;±lÛï cõVþ7WS4 çõûÒúþãÃ^0X:#0-G'yê0uS)J·ÏÄÎgwazÎú¤qçΡ-Â> ¸»Jgê#eÜ/ÙÂÌï{¹ûg+`-4ñÇzÉ·GþÂZµáR¼6F^!-Ìæï^²¸t)bËï·¦ipbð[7(»Neì<shÖbgJ^ =! Qz@.#ÙÖ RÌ44çé'j¤ »+RÚ@¾÷@¢¿ÝB-Tmô WMüé ,FÚ·ælÄú,/VS¼5Û+h Ü3Ù¦-ý¦M¡+ïÛ',ºËÙø©Àm"q`gÆ/ ïkm\oúRY2év¥²{EQaïQÚ }IR¥xmÝã ¼@¬BëÑ7 Â@|;&7½<λGàwÂ@ /Æ ºà52N3}7¡L©x9üJ¾\TÄë.Äù?¯)ZE/:è^Rëâ Õ%ÈrËôËmP¦¸ ÌN¶¡Iì¿49GHë×Þ»y»áó[Jà+¼J<Äu? ó D§þJkÎصú ãK<´ Ãbj³t1¢ù*l3q ¹ÊTÔFÅÞÇ´Û§hÓt]G^³}¹Ã»SWxy«ÁÅËÄ eGDJî~¤ºÎ??8§ +wpFT©Bk¿ó ÓÔqwGí3¥Ðño/)na8; ¡8Z ¾[Æ yÀRª?gê(_9õ oôí/.ÊìJhååà¿ Dô¯NÀz¯ÏKÎý'Ï´Á^%;Îs@¡¥_Ñ«°NO䥨ÈigD_²Dpñò»@ÕW|Þ +˦Ç6¼K ×<¦]*ÕgY·?¨ÄËYcÿ &+¥[Þï ±jûËëµg Ô=¹8o=&iP&ñá/"ÿ 0ÏR]ø:óX:[''Ï]j$¨ÇªÉ͸Õò·«\w¼ÃAãßÁr]¤ºq»ã0ïlqs$Õs)"ÑÁ/Ö´uÁTZ~j 9 ÝX.:Ä ´7´Ò³¯Ð;xð(4¦§¦`$;ä8ã´r4J]hÿ -£^.|Jp1é=Ü=ûÆq¨÷¬Æ²ÅÙýN r³ ìDrïñÎq*¶JØË9ôïÿ Xå¾~_´Ê[*,.XÉÑéX( ºÊ7YeÈ·vã;fH¹ëµdê[,?ä¬J ~Å úEËðRÚMÇAò~?QÌÊòÊR¿mºkÚHª+hÎ|þq0Eµ«ö·Úq¶Ý §ï´²âÍãáÇ(«Ûí 5;qV&I´°·}Idp¥Nzôcó8±±mhâ·þ°·zÉÛYÏÙ\¸0bÄÑÌÏ¡ø&º'y°¹9 øKN¿ç]yÅdo÷#E2oê'.¬6Vñ¨qxÝÿ ¬À¥r:Kÿ © BZbï ®îåè7 4 õqÖ 8)¢c£Ï§Ó_6Âh «³ÒdªÌ² 8ô`ûCÀ¡ CdåB ^-â 7AXïðò Û^ÃÛã©ÇE§Ô³pÇUZtÓóÚTùº¹±+m¯ Ô±òVÛí5WfÙí£MúBfiÀ0 ûËN ½ ÿ Ø WKíî8ûqà^à ¥N³¬f{'öÃ5$à»ã¤ÈH ×=åÊ û Ûù0Tlº§ã,¨KÌÁô«]ZýÈá¿ 4Õ5¸·2«_âBä{?<_¥JXg :\$\ Ó?ÇÐ~Ôú@ <¦7Vѽù=%BÃbÁ/÷ è²T 3gþ@µ Ö6ÊÕ~GõPXÏ¥~X÷fpǾcA(ó6uöd< Þ4ªßþO(å £O[¯XR s({j QRúD¾JÖØÄ jÞÃt÷w rr7-Á¹k#Fy~8þ b*û" ´//õ[Îe 7໵²(JØ {`Ó²Uä,uõë¿íJ¨Íeã·] Ä n®x¥®qÔ °`Áå]'9`£½ß,5+ I¾ìÉ@*ê72cÈÑáWøß¼¿@ãABÈXçµÎ'>¼ÏÿÚ ºæ³l,]ïÕví´©Ý^ 7üס" t,)û·×4 Ãÿ üÒ¬g½B°`kúÁrc è þÜ;Â¥ÆUvÐl¯ ³vVçÝC S§gÌÃlt¸ÿ 4ËCÓÌa:]v9ãn$÷ ÿ ücvÁ æ3lÜBå WþÃðskº ,0ÿ ÷¬I=d{JH 0ÿ ú¾RïÎôÚ¼¹ß 0 ÿ ˺yËîNÓ ÿ ú"uÐÂ| ÝýðáÿÄ 1 !0AQa@ÿÚ ?ß[^µhnêÝwR½4½ /ÑÕÆÛ¹/j`jlbCt_£]Qé>îóZIÈÕìº'Àey ó¢ÌÁO/må{a6%YÃ67Ù;ôãL4W!s¥q¢puÛÎzn ÒÆ+Àã N9ínº5!£F%èTüãø¼ ÀèùïCSN »Qô9ÖV%«Q ìÑø2!ÿÄ ' !1AQaqð ¡±ÑñáÁÿÚ ?#j¬wó b 0,¸rɳsæD+3W 8ÆND $0¡Ò³ßË9½ñÃÂQFiæ¼ád4;ûÂÛaëÖ"ÌüÂm_ÙÏ}à¬8T©PÍ þ+¯¨ë. ¦¨G·c/ë8 Äau¿çm7à"JÀàÍb% tÏsa¢Ús×î%<ùH< =<ó³wO¾×õýÏFQØ»@¸6¤b¥@@Òó}ÉtW=cG7 Ê&%¯ÀýÍ"í¦|ÇæÈÛÒ´ûÊÔç3ç0E,MrJ̨ìþ¿Ù´Ú½¼òR妽o¦h÷¤º84\l] ¿~$C9+}ü{K UkFs1½höVþöoZ®ß¾yô´iVöVÕ+y@à à¸3E3üuÇuMûvýÿ ";é¾Á zvéÒ sÒ¥ýv¹BÒ¸ÜQÏKúÔ£Ý ¿iU)]ô ¾Z4í£Bj ¯Ö?>ÌK)Û®J»ïûûQVÛRýų= óm;B§5Êó\¢;BülÞÿ ä 85Àà0 !ÖØW.ÛyPé).6M¿gÜ FûÖÞ3îößß5 ÌRäºÿ à¢õãoä eE ±øõYR¦ W7ÍWñ g&M»ôk¬íæºÁVö©¯½¾%ëèsµÙ}ú_㧩¦`ë]ØíéÒ$Gh- Ðô HCÑuKÆSØß±!wPùÎm¼Ö[Uñ®oÄâ H@!Ì|ðP5 ÝñÅüÔGÚÆ5$§ a×è¸; 3¶æÿÄ ( !1AQaq 0¡±ÁðÑáñÿÚ ?ÚYPÙ¼lÈ jðoÏX1 ¬LÀÅ$ÕV¸ x[Ô ¶uo>'^v Ã8}<ËA%J»tÇ]eeDÖ¥i×ù}F0ìµA£nä ôcüf$u Yf'PÖK'è.ÍÜ?wle(6GV骱 ñLº%kÉnøÀr*PTzeN&¯3fÌ58U6 ÷mjÓ¬Þ£b°ï^Ì V)øúh_4Pp;+ z8!º<%ÓÓ8wT2ûøÈY¡#¢S7åï;¸V¬XZ¤Þ_¬ %ì+=d"2ÄHôäÛvëTnH¨ zÁ,iÁ°s¯zÎ0¸ðF×ÊWß {>*¸ãô~ãêa "v C g9]ó5oü8»pè4ÕìáìërG èQß06{Ît`jÐ÷mípä(vd 4o 9\UÓ4üÌ£qÛê³ ~ S*µþ=?³V&%¾ñ)Ü´Üî»ø2o1ªTlô¯Þ!J4§þ¸Uðæ5bk ¥Icw¾g? è 9`x{ÊÝ0Z ¯i½ ÒÆrkTx5®²C ¦×jûUüãöLIö/øA¶¼»õa|SJ#^ß4qpM²A¶ñKùpaF]êU/Å µT,Ö°kte ÁhWnÄpAàßå¸Úb×ÎsGé1 Qj÷Ï÷ÞZª"³e rJþMZÆUOA>²Q[\8ö =æµÇÄ6Æ"+ íw0ÕB¨xXW ô¤"N NÞÜXÐ WÄØ·ÆÆ´øåÈõ xçüc )])Èòõñ?ÊaÇ@ +ý×Æ/ç¡®ü.0e£ å´!(¤nù·úÈ-ì'-øÖÞ t0ðý §qå¾a`M#íÌ ì!Ý-ÿ [nW£A w ¸ ¢+羡£° ´0âHqçMV"¡Rñÿ ÃKªÉÐS7nÓ¡ûh<,G8ÕødµUÄmú?Ê} XÄ ¾WGÎVÊÅ9X|±Àv&áf÷§ûÀ¹1¤5Tä&ÔBLQèk[É@çQe_FPï9sêEUZý3°Çÿ ¹Jg6Më"u¾v£Ú(ä]¸ä ¥¯A S`=å±7iç }'ÒdûÏ¡ôçhñBÐ:ï &È8Ø ó øGâ"+¶í¨SxÓrÖºZ s b*ïS^ñi¦?El´®º UÆ£aQ fýsVájýh.ñ- ¼:u ðµåßwZÞ¶ªÛK9v/(Þë¬vÖ > Únç/¦$,F:õ~ûP<bx¹ÔtÛ¹£xËâ0« rï7 )øúL2}Ç_8Ñ+! 6Ú¸r,j PS¼wåBä-Ë䩾!&Lîj<Ãþ Tå ÉÉÌß¼¶á§Ü`ºg u4¼ßõûÄcÄØ»\m4¶^oo±ï÷á²^ÿ õÀ<2ú-§o%zFmÞP§{vÀ¿Ö Ú ß¾z çDþ±RßCÉGÒF»ß-]â=±ÃwIM¬÷unRΰ 5 Ç>Éõ9ËT«åxÄä ¥ONÚ~2Ò³¤×|ºÈeUÞÊ/;{ÞoRJÈr1yª|õhp#Ûu>õö H°EEÏIÃéøòTÖéF¨ÁÊiØËÉòað,-9W]®;wtätÎ)£Ï#iðûë7ÜtÓÚ=?>2öQ£Æ Ëyº ÞIÞ*ñÜDÙ¾t7r®ùÆ4ªYP9¸ãBÜéøI¼föì¼ÌJ³9ÄZ2¡4ÿ C¯¸îä R^&¾ÒìÀ¡×o¬Zm/r^#ÜO[Xµø5~ yà@!5*i©Ã ´0lJMÛýc ¯J#Û¸¼_ÌÑÏ º p÷Ô©Ö'N>9~¾æ1YëÞ)N Pv8=ÃÀX£ÙÞDö½0þ²xhµk©e³¶^07#XbÐh7ü¯íÁô´UÈ÷¯y@5×m7¾ÿ ÆlY|cf4 #ÞÙ<¡».1c[; û.¶JÒ ¢ñÞ!5 qv£ë\c¡>Ä¿X» JQ,¿úÍ¢ ¨Í-y×;-p⨿î'Ç_`еh»S÷HXB¨ÜfF^À¬|Ðq ½b¥9]|9?N0 ºã§ë&ah"é£wy± ë7C=â#¿¡µveëxûL,Ó¢¿ÆjLº35Þç§N°ôJñGýw«öD`'C£PçwOb ±I >üô ºïTÝ[û"(4ok=zýcâCR´ürÌ J- Pb IÒn`pä!¬ÎÙ"kª éÃÏ go8þ5 Äk`üäÑ©¹ãÓÇÆ5·§<â²°Îf =cÀsÙJig/ýZ(ä$?èaÚòÎ:ÍÂ:ÏÁzÕ°Äwtë$¸´g5È>±/9êúû}-%xswÆ°U5qAäìd{ %wÜ ]»?["¥!VÕ<Që dy?!l ¥U yÎ$¤ §rä: ý®¦ 8´1Á}ººÎ»«¡°ðìÞ'¤@U`½ ]HL¥NFAï¬EeA5wäãúñ5&Æ"i,i,ÙAÅ ©Êù$]Áäo{ØÐ,D_nvN4â²> ΰ Ö \zÍ À"Ĩ/Ê)&×Þ,Hf]ÅIÙ>I¾xÎ_a _ð?¬3ñwè'ßÐË1E HµäÐìÞËf\¿Kô Îc "(¯ Èî c¡#¹ûׯe P;! ÎÄãQÁ!Ä8¨I±#R${íó×ïo8¿×åÁBT-Á£i#¨ÚYa«;?}e ªãÝ`Ð ¸Ðb>qGY -ßÐÀ;Ãq²ö[ ãóÖêb"°ð¼3pT ¢+jﶢ\¥£ã=fí÷8'ÞL,ÒÏûÌ0Ó SÆVh -êÁw®Ù8¸ çIãTï| ¼ã#wDÒ inë®<Í¡Â tþZ5ѳÃRÃG5n@2"pIEÆ£ÂhÝ8ÈÕ·bë}» x[ ©ÖuÖöL V§¿ü ñß*3ã>X;r<Hïdzç; @nqªõà<´åÆ}À|zá© ¡(l£W·Þ ,!¥Dy NN]Ñ }a'Û~þ˶æHÖ¢<®ø1Pízt¥äº\o'è D«v³84óØ4tĺG" UâöÃÖ2 ´\Ópó ` nʶaLà0-þ;d^c®®"Ä*´ èrñtæºÄÒ&¸zæz|Õ]R þ{®3 ¥ÌúÆ¶É ½¥5)°pYº¼`cçpUík?4ßt¦ åè,!¿ß]æë¬! ×nî×ÆRK©¿9fèÉ]*k¼*°u(·_?Ã*HEéÌ#¡Cóɳ ùlÍ7fÙÞÇÍ˽á}0«ã5ia©_ÞPå´Ù'#4[ÛE¸ú´72° t¥uþùÿ J:"p»oø¥ô ¾ lE`ôj¬õ 7Áª6öv ýƼå4ÕÍ?@Inß(õ}G%Ø·½¬LUàÃÏ Þ5 ë- ú ÐwÈw0% {që*al¹E _Éà1GZÅ ºþC .Ø~W÷ôÆKAéáéÇB'# ;Û¹AªäEOkgq/!EËá ñ^¸}%Ãm½F´x©;Î:A®°çæOÞ¨LÂè@pºãN¼¹+jÒhTºp{ãUMìÚx®, X)S¾1ªA%äßâ1l+c ´=ä ظzsqþ1¸÷qu+¦Èæ ÀP\Ð-Q¡uJ¢lãýYN©Ië£Væ<úô©®¶¶ Ä|½õ¨¥Mà;YüÝ~ W-æP] 4ýb<à^u6gÿ Îfhæ¹Ì¶Ú<nÀ¹ lP6 Á®j»¸orgtÏQMÇã7q){lã DÜ°Bð* Ú¸IKÏ /++(½0ÕÈ#ÀA$Ù ò[ã Uâ x¡IÆ+Ë [;U¢¶ÏGY¿-æIÀñn£¬E!"Úç³PÐ%Qj©X:Ö¬ ?"â¼ ix"§ò hógqÆTò"jïÌù`(zÑø »b¼ùPò;0·ñ:Àì á µH-EÑJõ¬x Ar<P[u¢ U ®À º<t»Í§ÍAy¹)6ê÷É R[µèñtE ®Î>1d;^|ÝÉõ\%¨®xÆS!KAB(ÝTÚO BT¢ tÍ ²°âë$d EH«WM¦ÂÞNnßRÄ«½â A®¢#±ÝOç>ÅLQr ÍÈA)OÈã-Àè> ò~ÌwDèZ9äù9Ç÷³\s¶ïÿ q.DL íé@(òh æÆÁG} PÕ¡°Héz"©Yde%ØÊ)| èl=|d¦ÓPHàA!¼ôÅF°ÅAc`ä¶Æ#sE5£½(/63´UÛ5VØò±ÍªÊÃh q¿n1Dj ñÆ ÃùO¡övÃOÑÓYÐâÜÉ~14ÜUC¼¢ÃúHâè%M;óƯ¹r Ø(= 8/Ï£Z< éCN4 m^³dº¼Å(®WX ºÛwÎí¹Á¦MTJåãËç.× ¨ ÂΡkÛhë¼û¡övú÷ú\ÅàøÂÓã$¬QU^71Àë@ Î[äi0ó½ªXKj0)ek¥°ÜÕèuo t&´òíN°µÊ?X¸3Åþcè} 5øú_86¸+ñðs£¬àֿά^®®9·eSN·Ðk7Æq <9âÞ92üèéCedÓß÷0!4bÀoº}37B¾ö 7Á BËUgà±fôpñd F¾>pÌLæûÏä=¸¯ÆhÑ\ Ã:ý?ç+êk Ûæ&÷²z¶ ï«çc ¬ÛÑ!Ð ,cz&æNÚAð <lµE¡Â` ÚÕ ¯ ëÔ5^ñgCy_$@XÊ¢j´d+"Ä$¾$CºR *î$¥<@8a91d `OùϨ¯¬EAg#¥%ÔѮἠM!Ñfü5ïÆ @0Nóå3B¨Ð¨(] PÀ(±ÙJïõ .(ÄÖÑĤé2 7]ÀÔV4./+£k?ïÎ7´@ðÞ Hl ÏbË[= ï'% ¡_8Î\|ÉÓ0/t hJÙ£UQ'븶ØOayÀ Á8 TÞ7 !£.(V¤`fs½Ùh)PTìíºç?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 12426 |
| Response Body - size: 12,426 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ù¬ÄìóÛÏ»)¡¢Øéʧç¢Úêôã,y3e®êÀ &ùcÑ[Kôá¶Z8Û! }cÕêóèÝ$óPLeí0¯ ô3]Gª¦¼ûåëÏqµÅU¼$ÅA1 LNù)öUvèÁ÷ôÜ*Umðwk¶«"$ Ëm6äg©> ô:ÛÄ`bj3ÝOIÄI,D LMNû553ëOW 1ñ¾c?¨KéÀÒ "ÓvÊßdyó-<Ò¡Ç2Õ ½M!²Ç]'Ùêìvj²b 4Æi{tøj(Ñ_¥\Ù_ÐÆxï 0çM¦Þ¥ØcÇ t1Saè6ù¦xµ5Ó¹ÝÕoô¨°Á˵ÝmÖÚ<É«- ÇVjrvký¸oò]lÅ]Ñn.ÑM7×ÚVu}ðqÚùæfÀÉ^A£>Úi¹MzK0äç_dïÏx4ñ7¨ÁíÌ¡ô¹öåcZj»²¸ì"fN«²V²½¬6Fâ¯-AFÜ~ÌÕ]¼GaÕrH"H*H9gMÌÒz|¶Å)8Öפw¹¹o:xÔ9}2_D_GËuºÍ±\ötXã#W»:ãæmbg*¾®3ólnWdÞ&Í *zäÑëtEÙ3Ù³?D§§¼\÷ϤéSo&¹¾ôÞmN?C×I\,ë(ë¹é:|NkÈ㿲'ÕÛ K]¤ßÎù 9P ° ¢`Ó¸I¶¢½FõE³Lê7Ýçubú§/µ¦rs´tÎ4GO ÍÚ(Ó͵î¹ù=fÛOÖçF½Z|ÚÈlë ùñÞ T4LHÔñÕo]ØߥVËèVf2{/=q ³&ÀÓ5}OYÓ_;ÅÜUÙ , &&*@Ð:î»»¯²Îë°²ê,4ßA¯V]~mYÖm/uSzÿ £i}yÓkçÐ ÄM hu XvI=óa6òÖ\1ÌtÓ»>~£qbÜa·ßíë?ÊéR÷J¾§<µé¯´óày´@ PD jlØ ®NC¬ëpbØÄ0ÑHyõ²ùúЬ>3Ú ¼±ãôë{sÕ! ÿÄ ( !"01@$#23ÿÚ £ÍÜÀ¦7b 0ÿ ·Í4¹Úºµ°°E2« (ê tW.Vê×Ó »½Ýª¶£óÿ ´lM_äºßÊD ±P8ïùR,ZU»Î[íÓGæ®Hmö¼E°£;ìÄö¸Z©[õJ[ªo¦ÁOXÿ ß%G@eo´Ú~ÚBF»^^ËÊØy^V¹0÷;áàq¸ö ë¹n6\§µgúÚdÕÇ[v ~ÇU©o^N¤Ù¡î¹°l¼3)¸¤[°«z0ZÇGto¿uf$ÒA±0<c¥_RÛXTºfBÐ"ÊjÄÿ ê6 !ô©} < ]RÃJNkmgÑULëÇ_{Ø%{J.ñÓÒ ÕÄZË|ÓVî?XPé]-[ìzXQ?@_Æ¢ç,ÙßÓ k½Ãt¿k(VZîÃ0ù [}u¡bÜr°PÒvñ«ã3ÝâûK©ú(!_£Ëë{ÜæfQMj´-eõjʱô=rÑÓÿ 8ùt*;ª°¬«w[Ôº ib/O¼B!¡zMùìA~;©HqjÜÊOÈ(%NÙÉ9²e5`rlË8ËQP(êqðê-õnÑ*BÒ®>°Y¬°ÓäN·«v«{-3 nÚдâSÖTô[£¤U ^UbkªÒWÍU ¿÷=ÂqíöXÍgäÃß@böÚj¿«/g}¼¢E^ÍÉ`§9µE +!ñµY* Ú<Ü WKjåMj¡Ãu6tá>{賦åö4RδzÖ. N·îc©¼¼hf&!\w ÆRa(®'"ÜÃØö,᢬½ Î7±ÈtmÑ© &µéqjËòðlÄÄÇÏ@PU,E´&¨¶ÖìX`üb&AúÄ®¥µVÁXºíæg ûãDs]¤¼hõ+)FéÐVµu,zóe¨¢¢>VR"زÆ5³r_óñN6é%öQoGs!\ÅòxßèÇÈ3Y±«Âó(å--~KïøbÔ ½e«°'ãJ¯Ûm[qdäLÌÅ¿ÓgXÙbD´fYYøþö¦YP(þºÒ´ âéð©ú)n+ÏÈù¢ºÕ·{¿ç]¢)[&èÂÕSb CùÖ¬ Z§ä Æ`uÛ·*ÈÊZ±[ñÓ$ÛN&DUdÓZõÉéx+ÓPK5|u²uýAÌVÁÛ32¯,ṉÈöÄ--x]YuléRJ¶&Â±× OÓ ÌÄbhfk¦ÊÄBâ;æm,»`OêØ +BÑY@E3ýË cC ?° T1WÖ¼#Tc{ÊÖ«I)´j?¶'Q¥õ2_(}m+£;ͳó²G¿Yä0ÁÄu×ô꨼«Z0ÁÇÅõ'KVZõf U+Éó ÛllÅlEaãÊÈÃÊYÈ ÿ ÿÄ ! 01@A !PQqÿÚ ?zåWÄ!Ü~£¸ÕnDd%L@ëÕUÌATHÉ#_GBâ`oA9ÑH¤Hï÷NTG!àÿÄ + !1 A"02#3@BQaqðÿÚ ?²¯BDÖÄ Öè3 ö»@ `Ƭ5¸ªÞ×tpÂsÃPîZ OÆÈqâ §LLÅÛ¤hç!Á1ùsé5ù <s©1¸ðFá2KåZש{Òºc% xBýê@¿Zr} dóADÒëMx9¡Ü§ Oð¹Pâ1;&?»PúZµ_¤#ÙH]tâ Å dÿ 6Ið"ö_¨¸xä¯^TÄZYr1²YÚù(äp³JõÔ)G¼ø&c_ "2; ()l¸£ÀñÊ=GÇ'²ßnBؽ&1üé#\';Ð6èXm²¾ÏGǹ )ýQ`§r£:40ò n FPê¯ OÙ[PQ³Ò§kݲlO<T=QoóËLáÖ¥ë+ðPÛwEÓ3þwÆÑNF3YÒéÙÛñ@ >ÒhZk Ôu4h.˺N¥¹ ;V¡¸Ü¾·<ÝÍ$8´÷oûL²àòóet¬n9iÔ´fJé ÅDòéÜ¥ÿÄ 5 !1"A Qa02q@¡ð#BR±$3PÁbÑñÿÚ ?`'7,©, Db×lã !À Lùô*x¢ ê tÝ-®å5¬ÝC¢ChÙé·§#ø (gæ YÖÂúØVÈXÛ ´áTçµWÙuÓ;&0tO1o¨B{ôEÜ!}ð®ÀÑÃR»ê«çKͶ=¢&C5²Õe]½VþA 7Q4Ý7¶È½ÆGeADàplÀ}Ô7Ò6Yo·ÀFØÖMù*fͼªsé) »·¥°1~«ùUmzz@ Ðê«ð`(ájC-A_nª ¤ ,8ÙPHØ"î ½þae-»B´2ýL)/Y¨D* ;vòK¥C¥ÚpÊD â.}Í{yÒ º,7P\á h²*Hò§4\Á.?E' ]Tä"Ý0 q:z "¸ThKã(DswòèQºÅ;?nò ¼H¥º ªâcÕÕN£@³WeUP[ß Ð²ÊÐGUNA;óÐDºÈiB.ײÒkEI(=ßMùOF¡J¢à wB£éÍD wYFÄÀQva9Ä*-MHH üæ6C>ê²7\Ä«¢Ú¹½Óª5 =]w~SË1"Ûî³ô^¬ï0!xMv`îÔDþcæ·é¦ Z&êdy¤P¨vÀÈòZ*A*+8ÜVÁ Àè0 ÆnÊ%xfû{¦æVÐÔn¦þÑk½Â¤ùy`¬¶*]^ÊÈw·*Vfí*´D(BNÖUöó=Pø Ú>ÿ ñiÔ$üÑ@ø0ìôT0zcÿ éÈ5ÂxD$R&ÔÃþ]:)Øvh>\ÚÐÊÎ# æÍþKúpÑ·z(ËkBI lðæFÐK;ï @+ð©¬óõUôìU`# 9jí¬sIÜ(*¶älÀüy§QnÉ¥¦» !tSÞU0ùPíèØC>û#@TÍO=H2Aqý*->B'vÖÖYÌ9WHêJ&¥;;`{]ôV)¢ò©«" íJ¦Ìì´ ¸é2ª+('°øμÓYÝJ§¼¢ V$eÜo®_PDGítØo²Ãfë,Ô_±YÞðÓïÙ5º\rGn%¶ÔL*LtS5PØÉüá§êÀV¨Øa 4n\/K¨{FgöEærØþÕý× ÂÒêBým¾SúøÄ @w ¤´oh£·3¹Yx-êïËû§ ½*5ÍYíÑC 8D»ýÕpÜúØHTÒÙë4DíñÔÀNȹ³â8Ìfõæq dl ý¯p«mþ{å~ú§x¹L8åÓdÊíº¿ø<¤D(seÄsÈ©f}ð-ê³8ú¿ÏùG¿DNßRáq6#uxyræ«t äAtcpi0ziú¦°êâpÌÇê¥Ô4ý~ûã_1Z¨"g Xlp¶YÀ¶©9Nè`ýýº£ Æð»b&]a1)¾ ÃGpáÖñI6EÿÄ ) !1AQaqð @¡±0ÁÑáñÿÚ ?! LªûD¨}\ËÄϬu@ÙÌ·CEcÄDj9ñ®µ æó)h?[¿æ´ _m«Þlö>vtx:üøå tÛ0-e1UCLµô¶²xìídçYÌ7FMÛl¦zb ócÞTp»ÕP ©¡³¨gE£/#ÞV®ÕôýÁ´{O橸X<Ec.äLBç å *¥¥kLzFa © +xî/Ñ]ï=så pTÒ Ë #j¤¾9HÔt&Æ ÔʪîQÐv³C GæpAª´¢¼ÿ ³Æ.íÇMöwÔÐøUÄ $it¶% ç´©Û>!úXÖ' µI ªPû7N¼çæ m®åJÂظ`Öþkñ4úó/´Ø¬ ×õ)phÒ bæ3?`U¾ Ô!MëÀD«0 ù&jëe©º£ôáÑn0%$¸=¨H6Òá²cA·åÀ!à Ë~>T¯Â2¹Ù-7)W¬bGÆZ-kAÌlNÔÙoMçäþ¥t6pØWÎ(@BÈ45éßø¹ ÆàסXµ}=à>)»|bCöBTм_>Ñ°*¥ôò%Ê= æv«óqµÉ¦#§Hïë7 ©gµæcÐ rg'YÀ`ÕeÃþe,b¸.%x=QÀÛ ×ñæi´Üʸ zJ0À/l;èaÌ+Uu:é¸q .ÞëÚsÃqD\T9Ä_ÓÚôÅÜ=YDº.#£bùÍ£Füv; 2ÌòêfbªV¿;Aü5 +ÔÕOºµl<Ç¿HV,¤pé ;±lÛï cõVþ7WS4 çõûÒúþãÃ^0X:#0-G'yê0uS)J·ÏÄÎgwazÎú¤qçΡ-Â> ¸»Jgê#eÜ/ÙÂÌï{¹ûg+`-4ñÇzÉ·GþÂZµáR¼6F^!-Ìæï^²¸t)bËï·¦ipbð[7(»Neì<shÖbgJ^ =! Qz@.#ÙÖ RÌ44çé'j¤ »+RÚ@¾÷@¢¿ÝB-Tmô WMüé ,FÚ·ælÄú,/VS¼5Û+h Ü3Ù¦-ý¦M¡+ïÛ',ºËÙø©Àm"q`gÆ/ ïkm\oúRY2év¥²{EQaïQÚ }IR¥xmÝã ¼@¬BëÑ7 Â@|;&7½<λGàwÂ@ /Æ ºà52N3}7¡L©x9üJ¾\TÄë.Äù?¯)ZE/:è^Rëâ Õ%ÈrËôËmP¦¸ ÌN¶¡Iì¿49GHë×Þ»y»áó[Jà+¼J<Äu? ó D§þJkÎصú ãK<´ Ãbj³t1¢ù*l3q ¹ÊTÔFÅÞÇ´Û§hÓt]G^³}¹Ã»SWxy«ÁÅËÄ eGDJî~¤ºÎ??8§ +wpFT©Bk¿ó ÓÔqwGí3¥Ðño/)na8; ¡8Z ¾[Æ yÀRª?gê(_9õ oôí/.ÊìJhååà¿ Dô¯NÀz¯ÏKÎý'Ï´Á^%;Îs@¡¥_Ñ«°NO䥨ÈigD_²Dpñò»@ÕW|Þ +˦Ç6¼K ×<¦]*ÕgY·?¨ÄËYcÿ &+¥[Þï ±jûËëµg Ô=¹8o=&iP&ñá/"ÿ 0ÏR]ø:óX:[''Ï]j$¨ÇªÉ͸Õò·«\w¼ÃAãßÁr]¤ºq»ã0ïlqs$Õs)"ÑÁ/Ö´uÁTZ~j 9 ÝX.:Ä ´7´Ò³¯Ð;xð(4¦§¦`$;ä8ã´r4J]hÿ -£^.|Jp1é=Ü=ûÆq¨÷¬Æ²ÅÙýN r³ ìDrïñÎq*¶JØË9ôïÿ Xå¾~_´Ê[*,.XÉÑéX( ºÊ7YeÈ·vã;fH¹ëµdê[,?ä¬J ~Å úEËðRÚMÇAò~?QÌÊòÊR¿mºkÚHª+hÎ|þq0Eµ«ö·Úq¶Ý §ï´²âÍãáÇ(«Ûí 5;qV&I´°·}Idp¥Nzôcó8±±mhâ·þ°·zÉÛYÏÙ\¸0bÄÑÌÏ¡ø&º'y°¹9 øKN¿ç]yÅdo÷#E2oê'.¬6Vñ¨qxÝÿ ¬À¥r:Kÿ © BZbï ®îåè7 4 õqÖ 8)¢c£Ï§Ó_6Âh «³ÒdªÌ² 8ô`ûCÀ¡ CdåB ^-â 7AXïðò Û^ÃÛã©ÇE§Ô³pÇUZtÓóÚTùº¹±+m¯ Ô±òVÛí5WfÙí£MúBfiÀ0 ûËN ½ ÿ Ø WKíî8ûqà^à ¥N³¬f{'öÃ5$à»ã¤ÈH ×=åÊ û Ûù0Tlº§ã,¨KÌÁô«]ZýÈá¿ 4Õ5¸·2«_âBä{?<_¥JXg :\$\ Ó?ÇÐ~Ôú@ <¦7Vѽù=%BÃbÁ/÷ è²T 3gþ@µ Ö6ÊÕ~GõPXÏ¥~X÷fpǾcA(ó6uöd< Þ4ªßþO(å £O[¯XR s({j QRúD¾JÖØÄ jÞÃt÷w rr7-Á¹k#Fy~8þ b*û" ´//õ[Îe 7໵²(JØ {`Ó²Uä,uõë¿íJ¨Íeã·] Ä n®x¥®qÔ °`Áå]'9`£½ß,5+ I¾ìÉ@*ê72cÈÑáWøß¼¿@ãABÈXçµÎ'>¼ÏÿÚ ºæ³l,]ïÕví´©Ý^ 7üס" t,)û·×4 Ãÿ üÒ¬g½B°`kúÁrc è þÜ;Â¥ÆUvÐl¯ ³vVçÝC S§gÌÃlt¸ÿ 4ËCÓÌa:]v9ãn$÷ ÿ ücvÁ æ3lÜBå WþÃðskº ,0ÿ ÷¬I=d{JH 0ÿ ú¾RïÎôÚ¼¹ß 0 ÿ ˺yËîNÓ ÿ ú"uÐÂ| ÝýðáÿÄ 1 !0AQa@ÿÚ ?ß[^µhnêÝwR½4½ /ÑÕÆÛ¹/j`jlbCt_£]Qé>îóZIÈÕìº'Àey ó¢ÌÁO/må{a6%YÃ67Ù;ôãL4W!s¥q¢puÛÎzn ÒÆ+Àã N9ínº5!£F%èTüãø¼ ÀèùïCSN »Qô9ÖV%«Q ìÑø2!ÿÄ ' !1AQaqð ¡±ÑñáÁÿÚ ?#j¬wó b 0,¸rɳsæD+3W 8ÆND $0¡Ò³ßË9½ñÃÂQFiæ¼ád4;ûÂÛaëÖ"ÌüÂm_ÙÏ}à¬8T©PÍ þ+¯¨ë. ¦¨G·c/ë8 Äau¿çm7à"JÀàÍb% tÏsa¢Ús×î%<ùH< =<ó³wO¾×õýÏFQØ»@¸6¤b¥@@Òó}ÉtW=cG7 Ê&%¯ÀýÍ"í¦|ÇæÈÛÒ´ûÊÔç3ç0E,MrJ̨ìþ¿Ù´Ú½¼òR妽o¦h÷¤º84\l] ¿~$C9+}ü{K UkFs1½höVþöoZ®ß¾yô´iVöVÕ+y@à à¸3E3üuÇuMûvýÿ ";é¾Á zvéÒ sÒ¥ýv¹BÒ¸ÜQÏKúÔ£Ý ¿iU)]ô ¾Z4í£Bj ¯Ö?>ÌK)Û®J»ïûûQVÛRýų= óm;B§5Êó\¢;BülÞÿ ä 85Àà0 !ÖØW.ÛyPé).6M¿gÜ FûÖÞ3îößß5 ÌRäºÿ à¢õãoä eE ±øõYR¦ W7ÍWñ g&M»ôk¬íæºÁVö©¯½¾%ëèsµÙ}ú_㧩¦`ë]ØíéÒ$Gh- Ðô HCÑuKÆSØß±!wPùÎm¼Ö[Uñ®oÄâ H@!Ì|ðP5 ÝñÅüÔGÚÆ5$§ a×è¸; 3¶æÿÄ ( !1AQaq 0¡±ÁðÑáñÿÚ ?ÚYPÙ¼lÈ jðoÏX1 ¬LÀÅ$ÕV¸ x[Ô ¶uo>'^v Ã8}<ËA%J»tÇ]eeDÖ¥i×ù}F0ìµA£nä ôcüf$u Yf'PÖK'è.ÍÜ?wle(6GV骱 ñLº%kÉnøÀr*PTzeN&¯3fÌ58U6 ÷mjÓ¬Þ£b°ï^Ì V)øúh_4Pp;+ z8!º<%ÓÓ8wT2ûøÈY¡#¢S7åï;¸V¬XZ¤Þ_¬ %ì+=d"2ÄHôäÛvëTnH¨ zÁ,iÁ°s¯zÎ0¸ðF×ÊWß {>*¸ãô~ãêa "v C g9]ó5oü8»pè4ÕìáìërG èQß06{Ît`jÐ÷mípä(vd 4o 9\UÓ4üÌ£qÛê³ ~ S*µþ=?³V&%¾ñ)Ü´Üî»ø2o1ªTlô¯Þ!J4§þ¸Uðæ5bk ¥Icw¾g? è 9`x{ÊÝ0Z ¯i½ ÒÆrkTx5®²C ¦×jûUüãöLIö/øA¶¼»õa|SJ#^ß4qpM²A¶ñKùpaF]êU/Å µT,Ö°kte ÁhWnÄpAàßå¸Úb×ÎsGé1 Qj÷Ï÷ÞZª"³e rJþMZÆUOA>²Q[\8ö =æµÇÄ6Æ"+ íw0ÕB¨xXW ô¤"N NÞÜXÐ WÄØ·ÆÆ´øåÈõ xçüc )])Èòõñ?ÊaÇ@ +ý×Æ/ç¡®ü.0e£ å´!(¤nù·úÈ-ì'-øÖÞ t0ðý §qå¾a`M#íÌ ì!Ý-ÿ [nW£A w ¸ ¢+羡£° ´0âHqçMV"¡Rñÿ ÃKªÉÐS7nÓ¡ûh<,G8ÕødµUÄmú?Ê} XÄ ¾WGÎVÊÅ9X|±Àv&áf÷§ûÀ¹1¤5Tä&ÔBLQèk[É@çQe_FPï9sêEUZý3°Çÿ ¹Jg6Më"u¾v£Ú(ä]¸ä ¥¯A S`=å±7iç }'ÒdûÏ¡ôçhñBÐ:ï &È8Ø ó øGâ"+¶í¨SxÓrÖºZ s b*ïS^ñi¦?El´®º UÆ£aQ fýsVájýh.ñ- ¼:u ðµåßwZÞ¶ªÛK9v/(Þë¬vÖ > Únç/¦$,F:õ~ûP<bx¹ÔtÛ¹£xËâ0« rï7 )øúL2}Ç_8Ñ+! 6Ú¸r,j PS¼wåBä-Ë䩾!&Lîj<Ãþ Tå ÉÉÌß¼¶á§Ü`ºg u4¼ßõûÄcÄØ»\m4¶^oo±ï÷á²^ÿ õÀ<2ú-§o%zFmÞP§{vÀ¿Ö Ú ß¾z çDþ±RßCÉGÒF»ß-]â=±ÃwIM¬÷unRΰ 5 Ç>Éõ9ËT«åxÄä ¥ONÚ~2Ò³¤×|ºÈeUÞÊ/;{ÞoRJÈr1yª|õhp#Ûu>õö H°EEÏIÃéøòTÖéF¨ÁÊiØËÉòað,-9W]®;wtätÎ)£Ï#iðûë7ÜtÓÚ=?>2öQ£Æ Ëyº ÞIÞ*ñÜDÙ¾t7r®ùÆ4ªYP9¸ãBÜéøI¼föì¼ÌJ³9ÄZ2¡4ÿ C¯¸îä R^&¾ÒìÀ¡×o¬Zm/r^#ÜO[Xµø5~ yà@!5*i©Ã ´0lJMÛýc ¯J#Û¸¼_ÌÑÏ º p÷Ô©Ö'N>9~¾æ1YëÞ)N Pv8=ÃÀX£ÙÞDö½0þ²xhµk©e³¶^07#XbÐh7ü¯íÁô´UÈ÷¯y@5×m7¾ÿ ÆlY|cf4 #ÞÙ<¡».1c[; û.¶JÒ ¢ñÞ!5 qv£ë\c¡>Ä¿X» JQ,¿úÍ¢ ¨Í-y×;-p⨿î'Ç_`еh»S÷HXB¨ÜfF^À¬|Ðq ½b¥9]|9?N0 ºã§ë&ah"é£wy± ë7C=â#¿¡µveëxûL,Ó¢¿ÆjLº35Þç§N°ôJñGýw«öD`'C£PçwOb ±I >üô ºïTÝ[û"(4ok=zýcâCR´ürÌ J- Pb IÒn`pä!¬ÎÙ"kª éÃÏ go8þ5 Äk`üäÑ©¹ãÓÇÆ5·§<â²°Îf =cÀsÙJig/ýZ(ä$?èaÚòÎ:ÍÂ:ÏÁzÕ°Äwtë$¸´g5È>±/9êúû}-%xswÆ°U5qAäìd{ %wÜ ]»?["¥!VÕ<Që dy?!l ¥U yÎ$¤ §rä: ý®¦ 8´1Á}ººÎ»«¡°ðìÞ'¤@U`½ ]HL¥NFAï¬EeA5wäãúñ5&Æ"i,i,ÙAÅ ©Êù$]Áäo{ØÐ,D_nvN4â²> ΰ Ö \zÍ À"Ĩ/Ê)&×Þ,Hf]ÅIÙ>I¾xÎ_a _ð?¬3ñwè'ßÐË1E HµäÐìÞËf\¿Kô Îc "(¯ Èî c¡#¹ûׯe P;! ÎÄãQÁ!Ä8¨I±#R${íó×ïo8¿×åÁBT-Á£i#¨ÚYa«;?}e ªãÝ`Ð ¸Ðb>qGY -ßÐÀ;Ãq²ö[ ãóÖêb"°ð¼3pT ¢+jﶢ\¥£ã=fí÷8'ÞL,ÒÏûÌ0Ó SÆVh -êÁw®Ù8¸ çIãTï| ¼ã#wDÒ inë®<Í¡Â tþZ5ѳÃRÃG5n@2"pIEÆ£ÂhÝ8ÈÕ·bë}» x[ ©ÖuÖöL V§¿ü ñß*3ã>X;r<Hïdzç; @nqªõà<´åÆ}À|zá© ¡(l£W·Þ ,!¥Dy NN]Ñ }a'Û~þ˶æHÖ¢<®ø1Pízt¥äº\o'è D«v³84óØ4tĺG" UâöÃÖ2 ´\Ópó ` nʶaLà0-þ;d^c®®"Ä*´ èrñtæºÄÒ&¸zæz|Õ]R þ{®3 ¥ÌúÆ¶É ½¥5)°pYº¼`cçpUík?4ßt¦ åè,!¿ß]æë¬! ×nî×ÆRK©¿9fèÉ]*k¼*°u(·_?Ã*HEéÌ#¡Cóɳ ùlÍ7fÙÞÇÍ˽á}0«ã5ia©_ÞPå´Ù'#4[ÛE¸ú´72° t¥uþùÿ J:"p»oø¥ô ¾ lE`ôj¬õ 7Áª6öv ýƼå4ÕÍ?@Inß(õ}G%Ø·½¬LUàÃÏ Þ5 ë- ú ÐwÈw0% {që*al¹E _Éà1GZÅ ºþC .Ø~W÷ôÆKAéáéÇB'# ;Û¹AªäEOkgq/!EËá ñ^¸}%Ãm½F´x©;Î:A®°çæOÞ¨LÂè@pºãN¼¹+jÒhTºp{ãUMìÚx®, X)S¾1ªA%äßâ1l+c ´=ä ظzsqþ1¸÷qu+¦Èæ ÀP\Ð-Q¡uJ¢lãýYN©Ië£Væ<úô©®¶¶ Ä|½õ¨¥Mà;YüÝ~ W-æP] 4ýb<à^u6gÿ Îfhæ¹Ì¶Ú<nÀ¹ lP6 Á®j»¸orgtÏQMÇã7q){lã DÜ°Bð* Ú¸IKÏ /++(½0ÕÈ#ÀA$Ù ò[ã Uâ x¡IÆ+Ë [;U¢¶ÏGY¿-æIÀñn£¬E!"Úç³PÐ%Qj©X:Ö¬ ?"â¼ ix"§ò hógqÆTò"jïÌù`(zÑø »b¼ùPò;0·ñ:Àì á µH-EÑJõ¬x Ar<P[u¢ U ®À º<t»Í§ÍAy¹)6ê÷É R[µèñtE ®Î>1d;^|ÝÉõ\%¨®xÆS!KAB(ÝTÚO BT¢ tÍ ²°âë$d EH«WM¦ÂÞNnßRÄ«½â A®¢#±ÝOç>ÅLQr ÍÈA)OÈã-Àè> ò~ÌwDèZ9äù9Ç÷³\s¶ïÿ q.DL íé@(òh æÆÁG} PÕ¡°Héz"©Yde%ØÊ)| èl=|d¦ÓPHàA!¼ôÅF°ÅAc`ä¶Æ#sE5£½(/63´UÛ5VØò±ÍªÊÃh q¿n1Dj ñÆ ÃùO¡övÃOÑÓYÐâÜÉ~14ÜUC¼¢ÃúHâè%M;óƯ¹r Ø(= 8/Ï£Z< éCN4 m^³dº¼Å(®WX ºÛwÎí¹Á¦MTJåãËç.× ¨ ÂΡkÛhë¼û¡övú÷ú\ÅàøÂÓã$¬QU^71Àë@ Î[äi0ó½ªXKj0)ek¥°ÜÕèuo t&´òíN°µÊ?X¸3Åþcè} 5øú_86¸+ñðs£¬àֿά^®®9·eSN·Ðk7Æq <9âÞ92üèéCedÓß÷0!4bÀoº}37B¾ö 7Á BËUgà±fôpñd F¾>pÌLæûÏä=¸¯ÆhÑ\ Ã:ý?ç+êk Ûæ&÷²z¶ ï«çc ¬ÛÑ!Ð ,cz&æNÚAð <lµE¡Â` ÚÕ ¯ ëÔ5^ñgCy_$@XÊ¢j´d+"Ä$¾$CºR *î$¥<@8a91d `OùϨ¯¬EAg#¥%ÔѮἠM!Ñfü5ïÆ @0Nóå3B¨Ð¨(] PÀ(±ÙJïõ .(ÄÖÑĤé2 7]ÀÔV4./+£k?ïÎ7´@ðÞ Hl ÏbË[= ï'% ¡_8Î\|ÉÓ0/t hJÙ£UQ'븶ØOayÀ Á8 TÞ7 !£.(V¤`fs½Ùh)PTìíºç?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 3324 |
| Response Body - size: 3,324 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ø#»)Ó\ùÎMI¸± ©b@ Õ¼äT½y÷éäã¼ó×#=ÒÉ`h X©`PP T× .5ß~.|ºc=ó5w¤Ô@ ©¨±A@Ø×¥¸YY½¹véäãã=àÏ\¬É P X©uW\åV㧣ÍׯÏÇ-ã ¼¬Çvum(ËRj ×.Zó×£^>YÇ«+3Ö,Y-EX éuzxòÑ%¶ó½¹uéãáÌz±ÌõËRo"tËRj "©dÐËQb±} xë·Íé5×~Lsöù·Ã='f|·®§N ý¼W¼ùû3N~¸&äÑr²h §~¿/^¿;´áùý]xóëóç8ý?WYku S#=É P$ÑrÔ@ :Yzy5so-k7\{C§Lzä³=³,Ïi5ô&@)rÒ\µ´Í¢RÀN~[f®-× ×¯Öy{¦uön ¹4k+&*X¢( PH¢*ÍÚßZ¼Úé®<µwÃ{ÌwóÍç³3IÓ3I¬©¨£-ÉpѬµ%#K#[¸âÒo*-"®zS§¢òïè= !N¿2yÎ_OO?×C=@ATN¼MqçìPéÔïó|ù8ý RçÿÄ # P1! 02@B"ÿÚ ¯4ìò4ívM;piÆ)Æ)§ù¦ ?`;h ë8¡E±¦Ý~T' ! t )ò4(ÜþÏï´p\¸MâVåä ï AÐ9®î 6äÓµ;4Íø§ju8NÍ$-¼ìíQ ¸íÝbòA©Í^)ñ×ã²ÐÞ; ÿÄ & ! 0A#1"CaÿÚ ?ÚÉKdeeùY~÷ÔI(´bô_¡³S\{1ª] eé²üÌï¢ ×c{6j"ÛéºB÷ílÍmª#ºÞËô¹ör òDd) ['çe^Ù!d²Ê ù3¹ÆÌÙ£ ØóÔm5< )>ä-¬¿S50ÕDû~+¢ZyåÉrø#1K ¿Â;-ì¿;É#û¡! dül²Ëðd?·½¬²Ë,²Ë,²ÆÉg_£ä#~²ÄË,S²Ë,±ä§EY{I¥OÉ÷3ú6ùü{Y 6¬F#ìL²ÆÌÙd²¤EXÙÿÄ " @!01QABaÿÚ ?ê¤Pôà=8N#Óô(S¤|h¦(×Á(Ð-ä9 ç~ "â©t¾5>ºj%8-ÊÓ$CÑj'ë"jÅ+qÿÄ !P`p1 @QÑÿÚ ?êR*лBñ0E8íÌÊ&£ÿÄ $ ! 10@APQaqÁÑÿÚ ?!õÈZ?Oq99Ò! ¼\úE¢ G>F?BµBæÃaú$-#ôÈxücïVÕ^LÌKÈö>ímB?ÐÇésï|cÑí}äØY* ¡4 r2HM·GÓ@Ú,CX _dÝ¡§¿ôh¡4&ð+Xai¾F=ÓµBêá^<} 3Â~*àf¼®CéÎÉ Ú#£e0È Vu¦Z¡â3÷>¬&øMËTr3l$=_~µGØÉÈz½ ³ºZ£Ìz½ó·"d>¤'F¡6!#Xçá 22M ɺ¥ñ¶¤q~µ&ôBa¿àl£rÿ "þ¾aí£ÀÕh!4 $(kXM!ÿÚ ÷Äy}}÷ß_ëï¾ûï¾ Uè½÷ß}öÎÿ ûï¾IÀp2÷ß}÷ß}{o¾î@wß}÷ß}÷Û>H_5@C }÷ß}÷ß}ÏB²` ¶Ãß}÷ß}ñ.)ù bOnt`- @ G®lÝ~8q ´é¦' úðA.(°Â{ïcg 1Î8°Õ÷°Þ/v{æÚ¼Û}Hã¾à\wÇ à øuà ÿÄ ' !1AQ 0a±q¡ÁÑðñÿÚ ?º°Ä?P±EÄ MÇ4Áë8séweÈø~b#ºÑuìèY×CÉùÚM}¡H½A67øæY%AÄeí®%Îócyíd9ZdögsA¶ÊslA9¼¬¶Zq°³þËûìá<b`mlï¹S¯ïÑ>Æ >צÊ~ÿ Á.?¤ ±áäù8°x8ÜñãþÃhZëÂ}G{bÀqäçëli9u¦N}zùʺ.g¼¶»/ñ-§cÎ Â5ñ°°°°±øØÈ.N?d-;ÃcbGÁÓÑ(¸I*Éð¸q;,ö»¹ÿ |I K jvV%ÝYe-ÿÄ ! 01a@QÿÚ ?ã- ,÷,£ xOà [Ôõîx}ÄG¿ëÈ8 ÙwfyÏid ð<å§ ©$³óË,³ P×Rã &Ëñ ê<e¢ì»ÝÉìGöxyË<ò"jË3ÂxåYàE±s²Ë,²Ë,²È%úq¯ìIe2Ë,eYÀÃ'N2 äEu%A9,YÿÄ % !1 AQa0@q¡ðÁÑÿÚ ?è XæQä©_P2.9K%8KùjWÑ èÐYtª¯po8e/ç©_(W@ï °á±ØÕÆWxòÇNRþDøºþcV¬Ú2ÙuïÐF¥|bðs9KèlÞÉÍÝÇ z¾JzÂÞï{þæñã㬿Z¥9 Q"WôÙpn=ò/¡/ìÈ@¶3? Ð E¶ç(óOB_× òÞvË{uÝ Ùçòt¥Ä¯®nÈ[zÿ ÙÍÌ&G~¤õÎGxÓÞßòsÀ§ _u*T§ç Ry`§AÍÿ Äq+ ¯R¥J~ ½®,æT _¸GF bøq/Ò¢T©N$ SBFEÖËÔU¨ÍÁÍw7>Òlô\Z X£Ë(rmg(¸õH©Øò1Ö÷4$±¶*hâ-½wÜ8C«|héÐv+`vî_Ô©µÑDSzQ>Áç8#вûËðvæÚ4·eØSëqÇ·ñ-óÚ& ®hdç cËêAú\ íBÏháTnÚÊw4\¾|KûV8ؾaÕYÜ<¹N´¸øD¯¸N`źRébß·¬V,]\xÀÝô%|(ÓNêç²hT¿Qàºþç'3BWBWÇD£Ä£ÇÀåÉ»ªªwsû;°ó9ôý Éïaà²( X);䣨ó|¥e.(é©R¥R¥J*T©D£ À `d¸Åx"DÂWæRºp´§Ç]\´´§ÇP, ÀA¹{àææP&Ã!Ä;9¼î&b±D©D¨«fËþbf[ 1c (%Û}âTKÂØ d0 `ÜEm^¡¨EÖøº^»* îR"Kj£5¸ã)c )4âP7 ¥¥½qþ©²>¥JÒzAªîZ£ÍͽJ¡ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 3324 |
| Response Body - size: 3,324 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ø#»)Ó\ùÎMI¸± ©b@ Õ¼äT½y÷éäã¼ó×#=ÒÉ`h X©`PP T× .5ß~.|ºc=ó5w¤Ô@ ©¨±A@Ø×¥¸YY½¹véäãã=àÏ\¬É P X©uW\åV㧣ÍׯÏÇ-ã ¼¬Çvum(ËRj ×.Zó×£^>YÇ«+3Ö,Y-EX éuzxòÑ%¶ó½¹uéãáÌz±ÌõËRo"tËRj "©dÐËQb±} xë·Íé5×~Lsöù·Ã='f|·®§N ý¼W¼ùû3N~¸&äÑr²h §~¿/^¿;´áùý]xóëóç8ý?WYku S#=É P$ÑrÔ@ :Yzy5so-k7\{C§Lzä³=³,Ïi5ô&@)rÒ\µ´Í¢RÀN~[f®-× ×¯Öy{¦uön ¹4k+&*X¢( PH¢*ÍÚßZ¼Úé®<µwÃ{ÌwóÍç³3IÓ3I¬©¨£-ÉpѬµ%#K#[¸âÒo*-"®zS§¢òïè= !N¿2yÎ_OO?×C=@ATN¼MqçìPéÔïó|ù8ý RçÿÄ # P1! 02@B"ÿÚ ¯4ìò4ívM;piÆ)Æ)§ù¦ ?`;h ë8¡E±¦Ý~T' ! t )ò4(ÜþÏï´p\¸MâVåä ï AÐ9®î 6äÓµ;4Íø§ju8NÍ$-¼ìíQ ¸íÝbòA©Í^)ñ×ã²ÐÞ; ÿÄ & ! 0A#1"CaÿÚ ?ÚÉKdeeùY~÷ÔI(´bô_¡³S\{1ª] eé²üÌï¢ ×c{6j"ÛéºB÷ílÍmª#ºÞËô¹ör òDd) ['çe^Ù!d²Ê ù3¹ÆÌÙ£ ØóÔm5< )>ä-¬¿S50ÕDû~+¢ZyåÉrø#1K ¿Â;-ì¿;É#û¡! dül²Ëðd?·½¬²Ë,²Ë,²ÆÉg_£ä#~²ÄË,S²Ë,±ä§EY{I¥OÉ÷3ú6ùü{Y 6¬F#ìL²ÆÌÙd²¤EXÙÿÄ " @!01QABaÿÚ ?ê¤Pôà=8N#Óô(S¤|h¦(×Á(Ð-ä9 ç~ "â©t¾5>ºj%8-ÊÓ$CÑj'ë"jÅ+qÿÄ !P`p1 @QÑÿÚ ?êR*лBñ0E8íÌÊ&£ÿÄ $ ! 10@APQaqÁÑÿÚ ?!õÈZ?Oq99Ò! ¼\úE¢ G>F?BµBæÃaú$-#ôÈxücïVÕ^LÌKÈö>ímB?ÐÇésï|cÑí}äØY* ¡4 r2HM·GÓ@Ú,CX _dÝ¡§¿ôh¡4&ð+Xai¾F=ÓµBêá^<} 3Â~*àf¼®CéÎÉ Ú#£e0È Vu¦Z¡â3÷>¬&øMËTr3l$=_~µGØÉÈz½ ³ºZ£Ìz½ó·"d>¤'F¡6!#Xçá 22M ɺ¥ñ¶¤q~µ&ôBa¿àl£rÿ "þ¾aí£ÀÕh!4 $(kXM!ÿÚ ÷Äy}}÷ß_ëï¾ûï¾ Uè½÷ß}öÎÿ ûï¾IÀp2÷ß}÷ß}{o¾î@wß}÷ß}÷Û>H_5@C }÷ß}÷ß}ÏB²` ¶Ãß}÷ß}ñ.)ù bOnt`- @ G®lÝ~8q ´é¦' úðA.(°Â{ïcg 1Î8°Õ÷°Þ/v{æÚ¼Û}Hã¾à\wÇ à øuà ÿÄ ' !1AQ 0a±q¡ÁÑðñÿÚ ?º°Ä?P±EÄ MÇ4Áë8séweÈø~b#ºÑuìèY×CÉùÚM}¡H½A67øæY%AÄeí®%Îócyíd9ZdögsA¶ÊslA9¼¬¶Zq°³þËûìá<b`mlï¹S¯ïÑ>Æ >צÊ~ÿ Á.?¤ ±áäù8°x8ÜñãþÃhZëÂ}G{bÀqäçëli9u¦N}zùʺ.g¼¶»/ñ-§cÎ Â5ñ°°°°±øØÈ.N?d-;ÃcbGÁÓÑ(¸I*Éð¸q;,ö»¹ÿ |I K jvV%ÝYe-ÿÄ ! 01a@QÿÚ ?ã- ,÷,£ xOà [Ôõîx}ÄG¿ëÈ8 ÙwfyÏid ð<å§ ©$³óË,³ P×Rã &Ëñ ê<e¢ì»ÝÉìGöxyË<ò"jË3ÂxåYàE±s²Ë,²Ë,²È%úq¯ìIe2Ë,eYÀÃ'N2 äEu%A9,YÿÄ % !1 AQa0@q¡ðÁÑÿÚ ?è XæQä©_P2.9K%8KùjWÑ èÐYtª¯po8e/ç©_(W@ï °á±ØÕÆWxòÇNRþDøºþcV¬Ú2ÙuïÐF¥|bðs9KèlÞÉÍÝÇ z¾JzÂÞï{þæñã㬿Z¥9 Q"WôÙpn=ò/¡/ìÈ@¶3? Ð E¶ç(óOB_× òÞvË{uÝ Ùçòt¥Ä¯®nÈ[zÿ ÙÍÌ&G~¤õÎGxÓÞßòsÀ§ _u*T§ç Ry`§AÍÿ Äq+ ¯R¥J~ ½®,æT _¸GF bøq/Ò¢T©N$ SBFEÖËÔU¨ÍÁÍw7>Òlô\Z X£Ë(rmg(¸õH©Øò1Ö÷4$±¶*hâ-½wÜ8C«|héÐv+`vî_Ô©µÑDSzQ>Áç8#вûËðvæÚ4·eØSëqÇ·ñ-óÚ& ®hdç cËêAú\ íBÏháTnÚÊw4\¾|KûV8ؾaÕYÜ<¹N´¸øD¯¸N`źRébß·¬V,]\xÀÝô%|(ÓNêç²hT¿Qàºþç'3BWBWÇD£Ä£ÇÀåÉ»ªªwsû;°ó9ôý Éïaà²( X);䣨ó|¥e.(é©R¥R¥J*T©D£ À `d¸Åx"DÂWæRºp´§Ç]\´´§ÇP, ÀA¹{àææP&Ã!Ä;9¼î&b±D©D¨«fËþbf[ 1c (%Û}âTKÂØ d0 `ÜEm^¡¨EÖøº^»* îR"Kj£5¸ã)c )4âP7 ¥¥½qþ©²>¥JÒzAªîZ£ÍͽJ¡ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 9692 |
| Response Body - size: 9,692 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ôímm°Æa:YÆã[jP<½ TÄd MS$ 9=Ï;èîè°[Åvî}[çþ¡XgêñºUûy;¡ ±V jÀÏz!èúnk£KÇ?râv96ÕÓy^Uãϵ§³ÒN·3uÈíåÁ±å)ÈÃ-ìß0ôöÚ>¾)Ò+hÃÖÀ Á |££ ¿-ô¯È·ê¶~Ìåu´v°Fî¥å^¾ÞÔ:Ójr·ÕDùn_Íú>}G÷Uºìþ«³©ïÒaÍClz"ES F`>X´÷|"Ñú´Ç=ßIâ³k{}b¶y,8ó× {ñz¼»ZöK.«+>½^{½£º¶ÀDT£(LUhËenóV&¥â'sG±ñí|þ?8ôÔ=-.¿·8Rê®q1å= gè q2ñ:þѪ±5 ËÇwÉ &¶2DÄÆ(º'kÖxêl}ÞË ÏgÎú½<éñó÷7Ä=§%/¯ÅÅ¿ö/ûvssöõZ¸zH |¼w| M¦<£Ó³ôÏ}:w -6xígÌçÁ©µ]óôΦ£ïñô(¬ëzÞ·r+jáê |¼w| Qj¦ÍXËÓ>mÑÒ÷úf çæ.4¶nÉ>wo õLeYiDÛ §+[±]»cËÏ\Ôy{ Ë×w|XU"@ dF½vð'ÔzýÓ¡IäTØÎj_¬ç 1åÇ*jí5ö:õ¶9Ô >àó!Þr $ÅТⶪ¾+V&½^^<3úN_5ë9®6|Y::B+d¥k+n föÜ åÚ¶¬d 2 ç" ¤ÄJÕêü¬xúýÚÑF+ KÆ>§¶·fc¼áî¡ÈAÞr0 T+cÒ>MC?>öáÈÜãÆz¹]3&×6|½nÙy ©±ÿÄ ' !@ 01P"#3ÿÚ þBl)ÿ VX&{¿Á%ãâå× r0« 8ѹg6FØ´=þO?¼èï(ðr Ç!§ÌN?ëS9nB i3ýébgÖ·`áãc[˶ùÙWFÒ²°Ö°/×mÄ éïQÃÕÊ¢a ñÞÚYS«¯)Èsâü a²U^<iîm ©Í>ìé2¦ «#kc ¥|Ì© ÿ y¯x¦ 1¹§Õì%ÖÔ×Ô6ú¼g-V'U G¦Ét2Q2Í:Sêý Ï9w÷ÔNq#ÙYTá1êÄaî°dlº8˯h ¦Ns űîÄq=l JuR©{g*:U¬V´» à"7þB";Ê×®~¼b§5N®«¨åÇE QÄá9Y<3×?^3ã+Ze|UÐÄ¢]ÅMB;JB ñ&+¯vVV<f##z]W}Æ@®G$rk¬È1P9ÉF2&_çtQªKmO²ëIöe¨0½ ÅÇ §ïkO±Ç ˶Î÷p$HCÚ9¡BÔ¥õ ´Þý±I°êõ^2Ø; ÑÙÚÔHôÄ3 ¿<[g 48ÃL4Ö¥ç<ûAÓí É.2eÓ"q'¦>IyÎïBë¡6ßò£!/g¨?ãXK»¦.>dëø: jáÐ=3ã4«g£iÎ+y1êqÚad¯ËÇã$0âäVʯî¨F¡h ð#~7TÚUuöÕì 'Ôö2©ëCaÜü©ÈðÔ=³±£ÜáÇñö-Êbë{£QÔ:ÚÅý9Ï')$Lÿ N±òc/8NsIü\z'ðR» ø2^¿FH#)È]cëõçËgÊåÜêßÿÄ ' !01 "2A#QBÿÚ ?k¹ (gÉCüzGs BAÈÿ pð³¾PÊdlÕ¾V4ûpM«ëjûxþÓÊlí®h%¡Ç¦!©}pÉZíÊtÚ·dÜ×LuúPêLË×Ê2Ç;tþ©qÝXæ¡oÙ\RÍpÂVFv«MÈtÏåÔ£uèqM?j7¸ ýû_èpzâ|o¨ôZµ~L°ð£ÎÊÌP$oY ¢6ò Él_v<±<5Ü· ßzl;üÇi Ë í¨&e´»í1Û6Ðîô(æ hÈ)eL5Uù ¢ô8qwPÉ«k^ +2]¨èÙ^ßF%Õ%¶{ ¬<ù*YÆlòë¹u0¨¯Q}æXúÉ8jk®$[AôRÍ ÖØϤ0 0ÁC ï°Òp£J6ÁÀ(ïòk0hXs¾GºÿÄ - !10Aa"#2@Qq¡±ðñÿÚ ?e(pÞ [>Ë ¦¯êû +HFcr(åõ% ±´]ivØ~&³Lkl ÀýýøÐ03ë8Qâ¢fqL L{*u«y] Kqø]iNÞ±Þ[ qÊÒÞõ4÷iªGi§Õ×püÄGÈ1Û;xpå&ål¼r I^½8ÁóJ)î&¢õXéÊpÂf°;NfsÞÌ]æ¼bÜg>}Úd¼|b]ÂÙOÂv>Å¥/Þ2ç6¾e:[/Ý&<ûôU]¹ï*êWð¾þó[ÂÞuywM °´Ø¡Ð @ì72î ÕGlG^V+çqAóc!z ó:JàúM~µ%Saaçktýd÷jÎ!¸ ÛiºkÔnæ¬úĴ驦þ%C½¼î%¤ÇÌYM-kòA² <ÍoIPFÒÜ<½¼ç@ãjÃÕycü@Üà4ågÔ ¿×ï×ì/¡n\4Ò;)4[Ü ^©tëï.´ÚÜÇìm@Ãõ+nd e5ÏRØûËXtà¿öp¥¯Ó%5©_ÿÄ 7 !1A "2@QaBPq¡#R03brÁÑð±áÿÚ ?ò°¹@þ%´PQúäHuÓ/1K¹:e¡IТ¥A¤zAZÙ(÷&áPðöò Î(xF¾[^ÆZâRJÀ(Ú°ÁE=ý`KJ08Á74|<íS< ji ]HQé Öð¶_= !Sj,á4à=t®K+ýßÇIûÃ%¶\¹)IÉI ÌKSu{»E& 3dðÊUG«BÀg}½¸Ü4çë¡u$ ¾ 4Âì-o8Æáb¢Ú,ºé½G÷1@Ë·.[zYÅ LÏ£Lµ s®MÛaXXF+>NAV³ÚñòÐ¥zF$LS1` ÓfIÎU«½ÿ ó,£pØÁ×åw1Z5ߤ @¬b ³ËDáá·á¶8h3r`÷¾Ä"YÌáW1+ôSóIùÝÂøBj÷±¼]Èg¤GÄk+·Aí8c0º¾o«ó5£?Ö ©ÿ ·Ù3$U{_.Üêf¦ívxJÒx²ïÒ bÀ[ÚÝZ)H`,Ê&¤üáÄ}ÿ ç=\µR®°Ó/¶ h©hÆ@dʦ.PDÁ¸àñ¾Amäô9zB¬¡`ï$^±-U?wÇ( H§ðì.®ÏÚàÂ/ P ºÃ %Ûêç¬îRp ,íï4eÛMV$ÁÔÒ¦U%ËB åhrÄRÊõkh©xEqø¡:ºÕf=K8¦) ßËYo¤áE=úÊ>Vó i¾lç KB źèJÓKÀ[ÜdѾïùÄë%#©û ³ UcÛ- ¾' 9g¹0Jæ2çv ±ÐTCþX/kµô6pªC¨u´o¾zt TÆ÷ÄnþV 44¸ÇEpXà}^Þº³Ä#äIñ0ºÚ \G /-5tÉ¡(\}æp¥)ag·¡ ØQá6TWR0}Õ8Ifký;TÌp|%ðÓ2ei6-CÕ( Ä»õÒV²ÉÀ©zÆñ¶;iJ娽Êý¡+ÂyÄ8¤¼¬i7Ä! EH^0ÉÀa¶ Þ¬ &â)w ÌÜé¿»W´Tà¤àÝ"Cârïö Ïáÿ ánüy¥¯¸h|ãr<4m)),ªmLåT±wòKĬò¥9¶Ë$zGŪ\ÊZ¾¾E©\g<MýS{un@ IÂÖ V ñþIªÀøWüà bðuööýàXR* `3©R4'P PÖSr=`TèúÄE|$_ "XJ %gLCätÿ ÿÄ * !1AQaq ¡ð0@±ÁÑñáPÿÚ ?!ÿ ȲM°Ú?§¤Ç¶/θ9h¶>Fx?AûEF[³À´!uö¦º]y¢ Ò¬"»w' ç:ûhÞ,Y:«·2°7O¹}h&ÿ ÃCkzl´æ Iÿ ?åMº zÉ [XóPRË"àÙú8$sr?Ö&Yj ñ¼y¿-Og°÷úqö/näÓ Ùà M±¿XqcuÃÇo4qE)ο¾áK\Û Ýß ÄÖØ>Z6ÖÞÜ pT :üBC\~êÚõyRq~«êM@ÞòB=êä,ÜYKãõPL8X÷mV Av¦úi§½¾ÖÁ2Î DI{ÌAóY"*b]'{eÿ "Yr ÛþkVªtÍ*ÁN-ùßJ´[Íã=·èÖÏØ~iß ÕÈò>;ÐáÂmÆ>ê3MÌ Nç:. ÈÔåÞÄ»TÈ%Ç ÂEC3¬_ü]Ù24Ò©CAxÕüµ5³u¶úR¥¡¨,!# ©zµb&!³þ&HXö©©B- ÆþjrªÊ¯éY±Q"`þ=õÅwôÇÑ}IÀU9p¬É¥E¥0/ÄüjB&¢a¸Àérü¹.áÍ°üÖX|¸T;°²Bû Y|ÓIAVðM IfRI:SÖ¶ÿ å¾Öí9æïZH&É4n»3hY³Ö-ü«Ul¬½_Sõ¡¨©ZàôY eèvµYÿ fÑ=cZ)qÖ-Xæ à üÊã&1:ÁóÓ1Mùµ-iD,Ééæ!ÎÉ ?!Þ ÄeMv ²ÿ _PàÒknäÔ/bÇàßO[ê~¥x8§(TdÊkT°OÙiéza©$Æ ¨3I·Ë°DÔ@o§ZöóµAS)¦£tÜg\9z߬zÉÀmB 9ÚݶÜ;³ ûéÂbÐ X7i} [Cn À\lE´êàúZ© ²Tz¬ÄÎMÝiü-6 :[°Ò¹µ ÝMÇ;þ6©¥à' bwÍ[0"»N sÉPL2cÎÝ/H0r §ìÃUÍ!Å Ã.þCNõ ܽî\ø ¨²«2^"ßÚnQy¾ÿ h·Ìºm?5¢<êì&ëbþ* ¸c©:ö÷8Xê '\ö§BªH°ÎfúíÞxY ¾:PTȾësοc ÐÅ/öÙ!3Ïfëy.\bôI"Á²IhZÐPZÙ>Ô¦¦¢ÉD^ÌUò7T,µÔítcöÑ!M`h.ÌëW %¹-ÙØñ§ÚM/¡¦"º? +Ú 4ÒQÁuªZÃÙ e°NóScÄNnøö¦ª#ªü_¶ÂL Ìäuµ]þÓ¥ÁÀ?{Õà%a,G\Ò )SPÆ Â& ñFAÙPÿ æ®FíÏÈþ¢¦`p;´ð] Õ «Ö;ºV .rE¾c½?nði(FåHFbD´Oáòx¢~nù«X/7Ìéý£ ,F(ð[M"ân#¶"iL (9\E-ÖY ¥8NLoXNµ]ba îå(L.¼jÈFFF¸h´¶$gÛóL-±/ Jê@vΤ#P84м"ÎN¦ÒG=ìäìÊ`ó¿Ý4HH® ëxÚ*d]êhõÞª¡"ÄB©ª8<¥»â˧*ÄAcn\ £G}©¨Ê è;U¬´Ãûk5[5sÞÎ,iÏ¥- A²ÒC× ÑëF<Ë{ßìb£Ð W D4¬e¿·Ía ¹gkͪ-¨Ã{Å( c5Z@^&kàÉï7ÓNýêjº_ú5Âë-C{ÅP0"¦¦z éRwÒ¡BûÓ÷Ø\d°¦æ,ò[Í,i ËØù¥M4¼ønÒZN^V|·Þ/¥¹DÎ0ÏVhdØ¥ÀsB:×`ø|1O¦=HûRðq iÙÎö Û¥%TÖ®Zm ý *¶ m&°ÒÀD°ßÅ 5A n£öÒ±4n¤×Íê* rhCu ÒÌR¹aëÂ+ÿÚ Ûÿ ¼, ¬0à 0Òÿ ï¾ñ *¸ËJP 0ÃCo¾±³.åq (0Ãﾯ4}qÿ 2fs à ÿ ¾kcÌG:Á0 `ÃCh7À/Áóðý?« ê 0à <Èlðñ©+!0à 0¯^(XT0à ¬²¤gÜÈ`°Ã<2Ë( ®J Ã÷ß}óàÎõíú@| PÃ÷ß}÷ß}å0ñÑWÞ,Ãß}÷ß}ø ='qßÿÄ ( !1 AQaqð0¡ÁѱáñÿÚ ?ËЫp%{5ëÎgÔàPv :,ó\`¾ªr i=!hµ¼ !×ø¸ æÖ xí/·mB («2:cçisL¿3ÈõýE+Þ*Ò7ómÌãQDK:ð af$fT/5.Ê$oA¨7ÀªËn ÊfÛxQûR¨ 9ãÍåÚVñôÛúñª§Q¦SI+¡´ eƪä=öþý¥4;»:hå¸Ã©-C0¾1©qeÁѳ¤oÛ~ò>Ii[éÊmÚøå2·'ízJªÕÅF´4´z¸ÁÉIÊ/4ÏT?m~Ý"Al?Lev².¾» !ò£L T²[ç?+í <.\¾Ð«ã]ü³8|ª^º0&^ÿ .5Vmô.\½îÇ·£*@y=b£å.\| Ù °QõfRwÏ(a&GôÎUÉÞ L¨FpBñxöô,Âþ¡ ÿÄ ( !1AQaqð 0¡±ÁÑáñÿÚ ?HìÛÑØ'Ï9Ó bI9>×ä+ GåûzUÕ®èÉïÛ44½Æ|Û÷HÜ®«Æ±Þm1 Îc½õ¨õY DÉÄúÞôs¥RHzÜ¿ÚRÚL~£4ÈeßmèÙ3)Y´m1®¿ÖËÑ''³ôð£bãGoMG¹õ~4Û¿?u¬N'ã~ÉBGònR1ðü Z y¢EµÞÃõ¥FM¬ <ñÚ:Òå'¤üÇ2oÒÄ =( áɪ'pq¡ ¦-}u}Öûäz W©kÙbúðu#ÕöEEG¶*9Ô×þPü/6ͬ»EÂM&l§uÃRf¼(Îqåûi9 ÞY¨¨ùP7g~1D=ê~Éhl"¿#Ìp©2à×[*CÙLÿ jjW/§ÖëW;`¦¿#I´OÝë(¹CZ êúÕäh ±mï ©jGKÌÛj Eéù À²å+ >lÑÈA¼Ü¿à <ÔØ«®ø{ÐùIiI|3vì±bfVq>Ȩ÷Å%'íqrò±]L6Îu£ cÑnÕ-IWO[$ßrÖÿ (æLxãâd Â<ãÒvÊÀ·>of %¨êFÈ® Q÷M?2b¼0í:ÒE7Æðè»ürh)C7àówÚôx1:çÑùçmÈùé³D åH)Zx <µ Ù³ÀçªÀ~èå¾4¾²ÛüG§ÿÄ ' !1AQa 0@q¡ðñ±ÁÿÚ ?ú##öR?}>ÎáH"§"(rÙôÎAPBº©%Õ:! .ÆXè O²üûy4°^ãVÑq6æÃ˼¡áQKËSL+Í7(#á4qIS9EDO4âàáÐ b J Ü"¤ÊVÜÉ) Ø$®«ä×cS¡4N>· |}g;½qþ?¥?§ *ºåÊ6NR»pô/ ]ûÍÈÁCmA/~ fÇ7e$ ÈÏ/þãÅZUøpqªE[tpÐo4 =M;à þ^tgL$lX2ŧ!¾'Ó |>óõ;MÀ Èéý8F õÈ ¢VÒ#²âR] ® ZM(D0IÂé®ÍWJ ºa9ÆÝ[ ß³÷ )ê×f×ÖÜAM¢QÉJL6þJ W[¥÷ã ª° ;¨x¿8Ô¼IÂ®Í ·Þ §Ï'ðÁr¥ a:B<aÙ¼J®ÄÆðo¥Ñ RìxÞ X.ªÀyÕthØA,b·ç½¡o%vÐçÞràl¨AE-Þ¡ ªXá.V2% ®5#B5wJPE&¯\]ÿ ³ vKÛa)èÁl±®ÑPÎhÔ)ĤvBÓPOaA 6->",<$¯muURÝ×/ cípú¤LªÙm#D4 SÂ\]åÀp vÁr Q<,²qî×P4t` Ö8{ÈÜJ 7=*q.y] Õ¥Á,*<Dlê®C ²ý#Òfáø x%X¹ UB¸ v¡§ 4 §[ mME}Ã@1`X¯Ó«ª¤¢aÔkBOIçékÀ;Ï/y¾#®MdLQ6©tè'¥*TM@T ÐóñàQPÿ "m%zað:äì)J"`ÌD¤[KÀÍó/Ùä ¥WÚ×[%¬ À ÄRPR] ÐÎH.ü«UÁ bB»?Ø9&(OôÊòÀ߬¢i0Oé?y#ÁD! NÊÆ 1WGaÖ´¤wõº>¿V x2PÁ`q(b2> Ù½ kn]¨]¥ð"Ñ6ó (lHë 0 ÊÂoCË9Ü#VemÕ:0È m©IÏ5ÎÏ8é ¼h¾EðvZ r:¢BuNëA*«ÏUÐh4 l ÐFÖ9K0ð`×¼%zò<â@lPi7ÍtUO¨Gí'Ð.(Ê0ïã9²×8 TNÔ®41¥ 2a¶ù ¯°Óes¢ãG)ú_8ïÐ, W¸¾}mªtUVrÕk vMR*©ýÎ#BÔµ-[ ræró¡ u¸ò!R Z8NQ1×ÓÃêwÉô'ßÏO¢cN1¬,&W>þòb¶Pt&ÂDR, UPÄO#LG¬Ô:T¯u5åBôAÍ@¼ç.ûÏ'õg¿ÈäÕ@¼é Ê|ðÊÉ>ØÖùéòïôaóÿ a£DÝ×cËG] R'j)qÇÄ ½ I5C9ÚÅUÂ5ÄÐ4Ö%&H÷»ý¸ âOh*I¥t85£ ü wÊ@þr{Ù8À=è Â}«&é O±ôïâdr|ýä¦"|ñÈᨦLð`¨ÊvòhÍ#Ç ahL#§ TIÁBÄMËw¡ (Q#¤÷&ªüngcÒu ©¢åÂTxÉ¡²! V(BDËÅ;B t à?ÇiÞªÔ<ñüq]8êØô¢" É®°¹y] ©Çº©ÎbÐEjJjk:ÿ (t¨ ¸éjâ© Ñbi·Û uT=¡[? >ôxÈññÁÃ)·â 1C5Ø?¼51Ø_`»#¶%p4Þê X0JlÀà)Å ÕònÌÿ §QAS¦#¥ ºßÀÇÁQ¡}¢láåÒ%¡¤ hyZDØ¥§"*bô¤vPv>cõ÷(Òx}8FNE!A+¹¤)Ò`^È :%=+>]?k¼§ëåk ¼@pêÀ <ÍÆúqv0àÆ{OxgÃUI«Fj^MFËçxô=fè$SnÍä¬ ¦L-¨ZT §mþÐÎaö©>9~9Ç9¸Êx¢A9PCXrÜѤt×þwÆNÇBÎ`¨ 4 nRAm °¤ w®i<9NBV Óã Ð0ËAîÔy´äf¨XÚoMt Ñ2coXïj!лúÄÚÐGJoO^sKo ¢y)o`ÜA+?Çû¼H#`M¶¼3 töu_ÅĤÁÓXZ°¨Î öÛX9 UBóÜTåRDbuÎq·©¯¤©A±ðÐËcGcS¼4º+ûf$÷ ®¿£x1$£Dp ñ0^ð)cQDP 5f¬ÀÁD ;VåÒUú¬$ ,:M_È`;ÑM ëYKF IúDé(5ø©LDÄ sÁ³?ÕË!ÓÙ#Vuµ½,ÙhåÅ¿ °K¹)ØE#ë'Ïõðõ2Ï ±U"©JÚÀÙu¢! ¼t/EÝi3iªnn³ZZ¯ãCÆmÀçû9?¬@÷ÒV¤ È8& B?ÈìÏÓ ³t§¯jÀ ªñI%ÙF jËw/yÂ1# 80_ßÀ Ý4[¬T<"FÄjEcªK:ò ÄûXx2<êÉ÷¶/9>°¬0n/y¥×Y¶cÁ.kXÄcÃëieh4¥£Ï(QD§Oã4¡AÇ-¦# 8ú p ¤Å b× ]Îl±RoæL?!ÃØëIù3jqPíZ ExÇf"}ô=cââ''Ê>Câ XBZçLAç r[¯®ÓA7äÙ0Ïxà&Ü&ãA/J§°¦}0 ¥ bi=9¹~³õŤγª[bA!+|* _áCÁð}KadjÆ:ªBóE ¹Ð°¾ ëÛåÁdNZP $IYU<à âúÖyøåügÕÊ"Êù1AÜiRJ¶ õÞrùy aqk~ j x ba¼øá]ÑÙ êJDv&ÎZ:ÓlLSúÅÛú1ÀôX@Yí×)ÎQ¤«È4ðc¼yùyüeò¯¦Ø ÅÞ¢ª J¥b«ÍJ$ÙÕ4£kÁOë Qra*h*(râÙ4H ãA/I]ñ¶þ ~Uq'Ðø8£ðgÐë)ÇÃ5A¨Ñ =T8m6ÆÃÌ]8WMC òæS§t¢£Ñ*c²¤ð ªð ¥y°:ÁÚ}a$p Öáö|c !òZÒ S@ÊÁwà héCNßlÞ¾ "@w»»3içR`£ëÈxÇÃ?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 9692 |
| Response Body - size: 9,692 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ôímm°Æa:YÆã[jP<½ TÄd MS$ 9=Ï;èîè°[Åvî}[çþ¡XgêñºUûy;¡ ±V jÀÏz!èúnk£KÇ?râv96ÕÓy^Uãϵ§³ÒN·3uÈíåÁ±å)ÈÃ-ìß0ôöÚ>¾)Ò+hÃÖÀ Á |££ ¿-ô¯È·ê¶~Ìåu´v°Fî¥å^¾ÞÔ:Ójr·ÕDùn_Íú>}G÷Uºìþ«³©ïÒaÍClz"ES F`>X´÷|"Ñú´Ç=ßIâ³k{}b¶y,8ó× {ñz¼»ZöK.«+>½^{½£º¶ÀDT£(LUhËenóV&¥â'sG±ñí|þ?8ôÔ=-.¿·8Rê®q1å= gè q2ñ:þѪ±5 ËÇwÉ &¶2DÄÆ(º'kÖxêl}ÞË ÏgÎú½<éñó÷7Ä=§%/¯ÅÅ¿ö/ûvssöõZ¸zH |¼w| M¦<£Ó³ôÏ}:w -6xígÌçÁ©µ]óôΦ£ïñô(¬ëzÞ·r+jáê |¼w| Qj¦ÍXËÓ>mÑÒ÷úf çæ.4¶nÉ>wo õLeYiDÛ §+[±]»cËÏ\Ôy{ Ë×w|XU"@ dF½vð'ÔzýÓ¡IäTØÎj_¬ç 1åÇ*jí5ö:õ¶9Ô >àó!Þr $ÅТⶪ¾+V&½^^<3úN_5ë9®6|Y::B+d¥k+n föÜ åÚ¶¬d 2 ç" ¤ÄJÕêü¬xúýÚÑF+ KÆ>§¶·fc¼áî¡ÈAÞr0 T+cÒ>MC?>öáÈÜãÆz¹]3&×6|½nÙy ©±ÿÄ ' !@ 01P"#3ÿÚ þBl)ÿ VX&{¿Á%ãâå× r0« 8ѹg6FØ´=þO?¼èï(ðr Ç!§ÌN?ëS9nB i3ýébgÖ·`áãc[˶ùÙWFÒ²°Ö°/×mÄ éïQÃÕÊ¢a ñÞÚYS«¯)Èsâü a²U^<iîm ©Í>ìé2¦ «#kc ¥|Ì© ÿ y¯x¦ 1¹§Õì%ÖÔ×Ô6ú¼g-V'U G¦Ét2Q2Í:Sêý Ï9w÷ÔNq#ÙYTá1êÄaî°dlº8˯h ¦Ns űîÄq=l JuR©{g*:U¬V´» à"7þB";Ê×®~¼b§5N®«¨åÇE QÄá9Y<3×?^3ã+Ze|UÐÄ¢]ÅMB;JB ñ&+¯vVV<f##z]W}Æ@®G$rk¬È1P9ÉF2&_çtQªKmO²ëIöe¨0½ ÅÇ §ïkO±Ç ˶Î÷p$HCÚ9¡BÔ¥õ ´Þý±I°êõ^2Ø; ÑÙÚÔHôÄ3 ¿<[g 48ÃL4Ö¥ç<ûAÓí É.2eÓ"q'¦>IyÎïBë¡6ßò£!/g¨?ãXK»¦.>dëø: jáÐ=3ã4«g£iÎ+y1êqÚad¯ËÇã$0âäVʯî¨F¡h ð#~7TÚUuöÕì 'Ôö2©ëCaÜü©ÈðÔ=³±£ÜáÇñö-Êbë{£QÔ:ÚÅý9Ï')$Lÿ N±òc/8NsIü\z'ðR» ø2^¿FH#)È]cëõçËgÊåÜêßÿÄ ' !01 "2A#QBÿÚ ?k¹ (gÉCüzGs BAÈÿ pð³¾PÊdlÕ¾V4ûpM«ëjûxþÓÊlí®h%¡Ç¦!©}pÉZíÊtÚ·dÜ×LuúPêLË×Ê2Ç;tþ©qÝXæ¡oÙ\RÍpÂVFv«MÈtÏåÔ£uèqM?j7¸ ýû_èpzâ|o¨ôZµ~L°ð£ÎÊÌP$oY ¢6ò Él_v<±<5Ü· ßzl;üÇi Ë í¨&e´»í1Û6Ðîô(æ hÈ)eL5Uù ¢ô8qwPÉ«k^ +2]¨èÙ^ßF%Õ%¶{ ¬<ù*YÆlòë¹u0¨¯Q}æXúÉ8jk®$[AôRÍ ÖØϤ0 0ÁC ï°Òp£J6ÁÀ(ïòk0hXs¾GºÿÄ - !10Aa"#2@Qq¡±ðñÿÚ ?e(pÞ [>Ë ¦¯êû +HFcr(åõ% ±´]ivØ~&³Lkl ÀýýøÐ03ë8Qâ¢fqL L{*u«y] Kqø]iNÞ±Þ[ qÊÒÞõ4÷iªGi§Õ×püÄGÈ1Û;xpå&ål¼r I^½8ÁóJ)î&¢õXéÊpÂf°;NfsÞÌ]æ¼bÜg>}Úd¼|b]ÂÙOÂv>Å¥/Þ2ç6¾e:[/Ý&<ûôU]¹ï*êWð¾þó[ÂÞuywM °´Ø¡Ð @ì72î ÕGlG^V+çqAóc!z ó:JàúM~µ%Saaçktýd÷jÎ!¸ ÛiºkÔnæ¬úĴ驦þ%C½¼î%¤ÇÌYM-kòA² <ÍoIPFÒÜ<½¼ç@ãjÃÕycü@Üà4ågÔ ¿×ï×ì/¡n\4Ò;)4[Ü ^©tëï.´ÚÜÇìm@Ãõ+nd e5ÏRØûËXtà¿öp¥¯Ó%5©_ÿÄ 7 !1A "2@QaBPq¡#R03brÁÑð±áÿÚ ?ò°¹@þ%´PQúäHuÓ/1K¹:e¡IТ¥A¤zAZÙ(÷&áPðöò Î(xF¾[^ÆZâRJÀ(Ú°ÁE=ý`KJ08Á74|<íS< ji ]HQé Öð¶_= !Sj,á4à=t®K+ýßÇIûÃ%¶\¹)IÉI ÌKSu{»E& 3dðÊUG«BÀg}½¸Ü4çë¡u$ ¾ 4Âì-o8Æáb¢Ú,ºé½G÷1@Ë·.[zYÅ LÏ£Lµ s®MÛaXXF+>NAV³ÚñòÐ¥zF$LS1` ÓfIÎU«½ÿ ó,£pØÁ×åw1Z5ߤ @¬b ³ËDáá·á¶8h3r`÷¾Ä"YÌáW1+ôSóIùÝÂøBj÷±¼]Èg¤GÄk+·Aí8c0º¾o«ó5£?Ö ©ÿ ·Ù3$U{_.Üêf¦ívxJÒx²ïÒ bÀ[ÚÝZ)H`,Ê&¤üáÄ}ÿ ç=\µR®°Ó/¶ h©hÆ@dʦ.PDÁ¸àñ¾Amäô9zB¬¡`ï$^±-U?wÇ( H§ðì.®ÏÚàÂ/ P ºÃ %Ûêç¬îRp ,íï4eÛMV$ÁÔÒ¦U%ËB åhrÄRÊõkh©xEqø¡:ºÕf=K8¦) ßËYo¤áE=úÊ>Vó i¾lç KB źèJÓKÀ[ÜdѾïùÄë%#©û ³ UcÛ- ¾' 9g¹0Jæ2çv ±ÐTCþX/kµô6pªC¨u´o¾zt TÆ÷ÄnþV 44¸ÇEpXà}^Þº³Ä#äIñ0ºÚ \G /-5tÉ¡(\}æp¥)ag·¡ ØQá6TWR0}Õ8Ifký;TÌp|%ðÓ2ei6-CÕ( Ä»õÒV²ÉÀ©zÆñ¶;iJ娽Êý¡+ÂyÄ8¤¼¬i7Ä! EH^0ÉÀa¶ Þ¬ &â)w ÌÜé¿»W´Tà¤àÝ"Cârïö Ïáÿ ánüy¥¯¸h|ãr<4m)),ªmLåT±wòKĬò¥9¶Ë$zGŪ\ÊZ¾¾E©\g<MýS{un@ IÂÖ V ñþIªÀøWüà bðuööýàXR* `3©R4'P PÖSr=`TèúÄE|$_ "XJ %gLCätÿ ÿÄ * !1AQaq ¡ð0@±ÁÑñáPÿÚ ?!ÿ ȲM°Ú?§¤Ç¶/θ9h¶>Fx?AûEF[³À´!uö¦º]y¢ Ò¬"»w' ç:ûhÞ,Y:«·2°7O¹}h&ÿ ÃCkzl´æ Iÿ ?åMº zÉ [XóPRË"àÙú8$sr?Ö&Yj ñ¼y¿-Og°÷úqö/näÓ Ùà M±¿XqcuÃÇo4qE)ο¾áK\Û Ýß ÄÖØ>Z6ÖÞÜ pT :üBC\~êÚõyRq~«êM@ÞòB=êä,ÜYKãõPL8X÷mV Av¦úi§½¾ÖÁ2Î DI{ÌAóY"*b]'{eÿ "Yr ÛþkVªtÍ*ÁN-ùßJ´[Íã=·èÖÏØ~iß ÕÈò>;ÐáÂmÆ>ê3MÌ Nç:. ÈÔåÞÄ»TÈ%Ç ÂEC3¬_ü]Ù24Ò©CAxÕüµ5³u¶úR¥¡¨,!# ©zµb&!³þ&HXö©©B- ÆþjrªÊ¯éY±Q"`þ=õÅwôÇÑ}IÀU9p¬É¥E¥0/ÄüjB&¢a¸Àérü¹.áÍ°üÖX|¸T;°²Bû Y|ÓIAVðM IfRI:SÖ¶ÿ å¾Öí9æïZH&É4n»3hY³Ö-ü«Ul¬½_Sõ¡¨©ZàôY eèvµYÿ fÑ=cZ)qÖ-Xæ à üÊã&1:ÁóÓ1Mùµ-iD,Ééæ!ÎÉ ?!Þ ÄeMv ²ÿ _PàÒknäÔ/bÇàßO[ê~¥x8§(TdÊkT°OÙiéza©$Æ ¨3I·Ë°DÔ@o§ZöóµAS)¦£tÜg\9z߬zÉÀmB 9ÚݶÜ;³ ûéÂbÐ X7i} [Cn À\lE´êàúZ© ²Tz¬ÄÎMÝiü-6 :[°Ò¹µ ÝMÇ;þ6©¥à' bwÍ[0"»N sÉPL2cÎÝ/H0r §ìÃUÍ!Å Ã.þCNõ ܽî\ø ¨²«2^"ßÚnQy¾ÿ h·Ìºm?5¢<êì&ëbþ* ¸c©:ö÷8Xê '\ö§BªH°ÎfúíÞxY ¾:PTȾësοc ÐÅ/öÙ!3Ïfëy.\bôI"Á²IhZÐPZÙ>Ô¦¦¢ÉD^ÌUò7T,µÔítcöÑ!M`h.ÌëW %¹-ÙØñ§ÚM/¡¦"º? +Ú 4ÒQÁuªZÃÙ e°NóScÄNnøö¦ª#ªü_¶ÂL Ìäuµ]þÓ¥ÁÀ?{Õà%a,G\Ò )SPÆ Â& ñFAÙPÿ æ®FíÏÈþ¢¦`p;´ð] Õ «Ö;ºV .rE¾c½?nði(FåHFbD´Oáòx¢~nù«X/7Ìéý£ ,F(ð[M"ân#¶"iL (9\E-ÖY ¥8NLoXNµ]ba îå(L.¼jÈFFF¸h´¶$gÛóL-±/ Jê@vΤ#P84м"ÎN¦ÒG=ìäìÊ`ó¿Ý4HH® ëxÚ*d]êhõÞª¡"ÄB©ª8<¥»â˧*ÄAcn\ £G}©¨Ê è;U¬´Ãûk5[5sÞÎ,iÏ¥- A²ÒC× ÑëF<Ë{ßìb£Ð W D4¬e¿·Ía ¹gkͪ-¨Ã{Å( c5Z@^&kàÉï7ÓNýêjº_ú5Âë-C{ÅP0"¦¦z éRwÒ¡BûÓ÷Ø\d°¦æ,ò[Í,i ËØù¥M4¼ønÒZN^V|·Þ/¥¹DÎ0ÏVhdØ¥ÀsB:×`ø|1O¦=HûRðq iÙÎö Û¥%TÖ®Zm ý *¶ m&°ÒÀD°ßÅ 5A n£öÒ±4n¤×Íê* rhCu ÒÌR¹aëÂ+ÿÚ Ûÿ ¼, ¬0à 0Òÿ ï¾ñ *¸ËJP 0ÃCo¾±³.åq (0Ãﾯ4}qÿ 2fs à ÿ ¾kcÌG:Á0 `ÃCh7À/Áóðý?« ê 0à <Èlðñ©+!0à 0¯^(XT0à ¬²¤gÜÈ`°Ã<2Ë( ®J Ã÷ß}óàÎõíú@| PÃ÷ß}÷ß}å0ñÑWÞ,Ãß}÷ß}ø ='qßÿÄ ( !1 AQaqð0¡ÁѱáñÿÚ ?ËЫp%{5ëÎgÔàPv :,ó\`¾ªr i=!hµ¼ !×ø¸ æÖ xí/·mB («2:cçisL¿3ÈõýE+Þ*Ò7ómÌãQDK:ð af$fT/5.Ê$oA¨7ÀªËn ÊfÛxQûR¨ 9ãÍåÚVñôÛúñª§Q¦SI+¡´ eƪä=öþý¥4;»:hå¸Ã©-C0¾1©qeÁѳ¤oÛ~ò>Ii[éÊmÚøå2·'ízJªÕÅF´4´z¸ÁÉIÊ/4ÏT?m~Ý"Al?Lev².¾» !ò£L T²[ç?+í <.\¾Ð«ã]ü³8|ª^º0&^ÿ .5Vmô.\½îÇ·£*@y=b£å.\| Ù °QõfRwÏ(a&GôÎUÉÞ L¨FpBñxöô,Âþ¡ ÿÄ ( !1AQaqð 0¡±ÁÑáñÿÚ ?HìÛÑØ'Ï9Ó bI9>×ä+ GåûzUÕ®èÉïÛ44½Æ|Û÷HÜ®«Æ±Þm1 Îc½õ¨õY DÉÄúÞôs¥RHzÜ¿ÚRÚL~£4ÈeßmèÙ3)Y´m1®¿ÖËÑ''³ôð£bãGoMG¹õ~4Û¿?u¬N'ã~ÉBGònR1ðü Z y¢EµÞÃõ¥FM¬ <ñÚ:Òå'¤üÇ2oÒÄ =( áɪ'pq¡ ¦-}u}Öûäz W©kÙbúðu#ÕöEEG¶*9Ô×þPü/6ͬ»EÂM&l§uÃRf¼(Îqåûi9 ÞY¨¨ùP7g~1D=ê~Éhl"¿#Ìp©2à×[*CÙLÿ jjW/§ÖëW;`¦¿#I´OÝë(¹CZ êúÕäh ±mï ©jGKÌÛj Eéù À²å+ >lÑÈA¼Ü¿à <ÔØ«®ø{ÐùIiI|3vì±bfVq>Ȩ÷Å%'íqrò±]L6Îu£ cÑnÕ-IWO[$ßrÖÿ (æLxãâd Â<ãÒvÊÀ·>of %¨êFÈ® Q÷M?2b¼0í:ÒE7Æðè»ürh)C7àówÚôx1:çÑùçmÈùé³D åH)Zx <µ Ù³ÀçªÀ~èå¾4¾²ÛüG§ÿÄ ' !1AQa 0@q¡ðñ±ÁÿÚ ?ú##öR?}>ÎáH"§"(rÙôÎAPBº©%Õ:! .ÆXè O²üûy4°^ãVÑq6æÃ˼¡áQKËSL+Í7(#á4qIS9EDO4âàáÐ b J Ü"¤ÊVÜÉ) Ø$®«ä×cS¡4N>· |}g;½qþ?¥?§ *ºåÊ6NR»pô/ ]ûÍÈÁCmA/~ fÇ7e$ ÈÏ/þãÅZUøpqªE[tpÐo4 =M;à þ^tgL$lX2ŧ!¾'Ó |>óõ;MÀ Èéý8F õÈ ¢VÒ#²âR] ® ZM(D0IÂé®ÍWJ ºa9ÆÝ[ ß³÷ )ê×f×ÖÜAM¢QÉJL6þJ W[¥÷ã ª° ;¨x¿8Ô¼IÂ®Í ·Þ §Ï'ðÁr¥ a:B<aÙ¼J®ÄÆðo¥Ñ RìxÞ X.ªÀyÕthØA,b·ç½¡o%vÐçÞràl¨AE-Þ¡ ªXá.V2% ®5#B5wJPE&¯\]ÿ ³ vKÛa)èÁl±®ÑPÎhÔ)ĤvBÓPOaA 6->",<$¯muURÝ×/ cípú¤LªÙm#D4 SÂ\]åÀp vÁr Q<,²qî×P4t` Ö8{ÈÜJ 7=*q.y] Õ¥Á,*<Dlê®C ²ý#Òfáø x%X¹ UB¸ v¡§ 4 §[ mME}Ã@1`X¯Ó«ª¤¢aÔkBOIçékÀ;Ï/y¾#®MdLQ6©tè'¥*TM@T ÐóñàQPÿ "m%zað:äì)J"`ÌD¤[KÀÍó/Ùä ¥WÚ×[%¬ À ÄRPR] ÐÎH.ü«UÁ bB»?Ø9&(OôÊòÀ߬¢i0Oé?y#ÁD! NÊÆ 1WGaÖ´¤wõº>¿V x2PÁ`q(b2> Ù½ kn]¨]¥ð"Ñ6ó (lHë 0 ÊÂoCË9Ü#VemÕ:0È m©IÏ5ÎÏ8é ¼h¾EðvZ r:¢BuNëA*«ÏUÐh4 l ÐFÖ9K0ð`×¼%zò<â@lPi7ÍtUO¨Gí'Ð.(Ê0ïã9²×8 TNÔ®41¥ 2a¶ù ¯°Óes¢ãG)ú_8ïÐ, W¸¾}mªtUVrÕk vMR*©ýÎ#BÔµ-[ ræró¡ u¸ò!R Z8NQ1×ÓÃêwÉô'ßÏO¢cN1¬,&W>þòb¶Pt&ÂDR, UPÄO#LG¬Ô:T¯u5åBôAÍ@¼ç.ûÏ'õg¿ÈäÕ@¼é Ê|ðÊÉ>ØÖùéòïôaóÿ a£DÝ×cËG] R'j)qÇÄ ½ I5C9ÚÅUÂ5ÄÐ4Ö%&H÷»ý¸ âOh*I¥t85£ ü wÊ@þr{Ù8À=è Â}«&é O±ôïâdr|ýä¦"|ñÈᨦLð`¨ÊvòhÍ#Ç ahL#§ TIÁBÄMËw¡ (Q#¤÷&ªüngcÒu ©¢åÂTxÉ¡²! V(BDËÅ;B t à?ÇiÞªÔ<ñüq]8êØô¢" É®°¹y] ©Çº©ÎbÐEjJjk:ÿ (t¨ ¸éjâ© Ñbi·Û uT=¡[? >ôxÈññÁÃ)·â 1C5Ø?¼51Ø_`»#¶%p4Þê X0JlÀà)Å ÕònÌÿ §QAS¦#¥ ºßÀÇÁQ¡}¢láåÒ%¡¤ hyZDØ¥§"*bô¤vPv>cõ÷(Òx}8FNE!A+¹¤)Ò`^È :%=+>]?k¼§ëåk ¼@pêÀ <ÍÆúqv0àÆ{OxgÃUI«Fj^MFËçxô=fè$SnÍä¬ ¦L-¨ZT §mþÐÎaö©>9~9Ç9¸Êx¢A9PCXrÜѤt×þwÆNÇBÎ`¨ 4 nRAm °¤ w®i<9NBV Óã Ð0ËAîÔy´äf¨XÚoMt Ñ2coXïj!лúÄÚÐGJoO^sKo ¢y)o`ÜA+?Çû¼H#`M¶¼3 töu_ÅĤÁÓXZ°¨Î öÛX9 UBóÜTåRDbuÎq·©¯¤©A±ðÐËcGcS¼4º+ûf$÷ ®¿£x1$£Dp ñ0^ð)cQDP 5f¬ÀÁD ;VåÒUú¬$ ,:M_È`;ÑM ëYKF IúDé(5ø©LDÄ sÁ³?ÕË!ÓÙ#Vuµ½,ÙhåÅ¿ °K¹)ØE#ë'Ïõðõ2Ï ±U"©JÚÀÙu¢! ¼t/EÝi3iªnn³ZZ¯ãCÆmÀçû9?¬@÷ÒV¤ È8& B?ÈìÏÓ ³t§¯jÀ ªñI%ÙF jËw/yÂ1# 80_ßÀ Ý4[¬T<"FÄjEcªK:ò ÄûXx2<êÉ÷¶/9>°¬0n/y¥×Y¶cÁ.kXÄcÃëieh4¥£Ï(QD§Oã4¡AÇ-¦# 8ú p ¤Å b× ]Îl±RoæL?!ÃØëIù3jqPíZ ExÇf"}ô=cââ''Ê>Câ XBZçLAç r[¯®ÓA7äÙ0Ïxà&Ü&ãA/J§°¦}0 ¥ bi=9¹~³õŤγª[bA!+|* _áCÁð}KadjÆ:ªBóE ¹Ð°¾ ëÛåÁdNZP $IYU<à âúÖyøåügÕÊ"Êù1AÜiRJ¶ õÞrùy aqk~ j x ba¼øá]ÑÙ êJDv&ÎZ:ÓlLSúÅÛú1ÀôX@Yí×)ÎQ¤«È4ðc¼yùyüeò¯¦Ø ÅÞ¢ª J¥b«ÍJ$ÙÕ4£kÁOë Qra*h*(râÙ4H ãA/I]ñ¶þ ~Uq'Ðø8£ðgÐë)ÇÃ5A¨Ñ =T8m6ÆÃÌ]8WMC òæS§t¢£Ñ*c²¤ð ªð ¥y°:ÁÚ}a$p Öáö|c !òZÒ S@ÊÁwà héCNßlÞ¾ "@w»»3içR`£ëÈxÇÃ?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 13969 |
| Response Body - size: 13,969 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ {ÅÞá¥{æ\Óbð78öJÙתH*HùÖrϵËéòVÙY1rÉ;¸ô5Ly0×°f× jâ6)Ô#³¤è4hÕvbRÒÞ·=òÚIv.s®No+ƽ)`©(u¡º»IR;âôyÓ¿^©ðv) ©Óê-¬j n(ñsäJS¶u^¡5&fÌfÈI4¶=ùåÜgôS¤±Õ#,ös%~¶ ©ÎäK£¥µeyÓ©kî4î¼ìç ³µ}Yèy¹Þ«ñæÙÈU@è¶ÍM¸XÊf !ÞCÓOhxnWbK¶Ë]ÐX] ë2%ct4µ¼ÐÄ£Ä$i/«=`ö ©¼õ{®ÂºzB×µlÜa¬½ [íY·°ékã|êÒZ&;åKu ;³¹A;Q1ÎméÒLª·IZ5 F[å4 tN ¦¼ÚÄ8@òx]¾RÍì'§~]ÄaتÃÎú:°<#,,ÐǶyÙØ+°EÈÀiÛcÅFÙSåÕ!LãvfëSmÊæ tkÍég!JýÀó@:5aËYì¼n Ìܧ¢dA£Þæ|íqõÎQE/y ß;ë7¨Wkf2àèº&LS¯:] ëÏvsÛåÑKOU®Ô¶µç§ihÀH ´X ¡'=ù¤Õ¦ª¤G©xYGÔíôû¼ ¾2CÅ´æ£Á¶õÈè[íÎ×%´æsRÆÚî=³´ i`8Ô`ãK³íg6¡n{ò è¨ì*,Ìæ¹Õ!ðuz¿ióJ|î»üͼ۪È5èðcÞØ9ö§cRnÓÙÆÚ VfÝ&Ñg'7;.âzFùK·= <½z3ãfçl¹d§}sªZ̧ ¯ËJuæ½ tÖ°úá :'Ð4w2G¢Ùi§3Z¶î4ÀÃÛdÒ uqfòó°áGêÇ=äëÒæVøÍØèuÊÆ>Ã+fÓGE·Áfmm`¼ÞîB ¡Kú ®7ò0Îóy lKw`À"ÑËL ²%g´ß íæ$d\étË5ÇY66×dÛUDÓ]ߨôGW)ät5-1u"+¨°ã«¾¤]']ôó=N&{+MlÞÞ{¼ÂCÃgVOËÌMṳ́¢~dzr<ÆËQaÑÉ1æ+ÜÌÊò?1ioG3qìÌd3Ì 3 !ÌZ¿· 4æ<ÚYYÝd÷ÿÄ ( ! "102AB#CDÿÚ zyTgÚ¹©GMäõß IÇ#Ú¡X.t¶Y ËÆ¥u_m%,ß$?ÊøﺸÈ^3Epë W,l jg«Mä~üw«Ëÿ )xè\hÙu©YMPvAbúé}ê¥|ä£â_;\iS²ªt¿ D{FËáCixÚodòÉTºÅiäOÔzØ«Búie²ß)Ø£DûU k® ) Âá3x4¢ë®/ýRý®,1Íq¤å¹+) Æ9aä]ùy1ÊSq I ÷ªÝ[Ã.×v&]ý|sM.ýS¢ãK'ÚT@_M'f]ÖÙÕÞUTÈ¡ ÷²-ÝØÞ%ìþ>,þµnñsNTÿ CKeêµòô.t¾ÞÝÇä+¯¨!Ö©vÍê©jÒª}pÙù®%,=ZV±.4r,¶]sæ 4õi ü:hË"¤9JµjÒ_¨¼ Í&ÿ ~Í-z«BãIÙæûÕK! ô_MãM'l`^ÙdÜÛ²¸èË#«z´ôe¤eé²-îöWéO ¸Òv íuú+4Ó±+º»/qU½³É½Öü{{ø·|¿3j£4ÍbÒ2ÃI^ÛïGìC {. ±Yc#^ÊÁBãM;º0R¼ùeÖ«¡at¬·ÅÊ¿¿VQò+"| 2gM2fûl[º;~oå \Jx=¹ÓNÇÌ]ÞJÏû>Uw ªT(RT¼«Ç=åî"ô~¹oÿ ß²?½;X.4ÑÍ#æöíeMö¥IJ¸Ø¼r4¬ q¿ ï}>dë®;J(Ñ!ÓºGÍïäÅ\Ø©hHHÁ\®W?#MObØÆI÷å tµÃ?gOQV·ÿ ´ÎÃ?) ¶(kQBBÝ õhâ¼ìå§ézj þoUÛ¯©É6½ñë#1B.P¾¨_UËÇÎéǧT|)%äTÓC%'9B&&&&oó¾ãìI÷Ãge©ö~HW×ñù.SôܤÇç¯Èüȹ%Ùçy åÚ»»E^óçq®pÍ7zÉò!Ûæ}ÒÍ4ÞXÆ> \îûrýJ]µaT|Q>$ÇBêüm Ô9«jr.uÿ óÒiñ¶VÙä8NRTGÆqù)¸NÈ/z¯]!äE¶Ç!¶Ì%¯Q µFo·oûS÷Â?ÓôFhB¹FaÔê*c¿ / ²L¢¿ñ²ß%«]<¹ÉOƵÿ ã§ÆÆÌoG?ñÿ 1[ÃmG] bØ´!\çadªR£ÜèEjåV ÁìQN<Id¿år×Üu%Æ %ÂÌuܤE_D/àÃY<1ÌQÁÛÃôaï©ëpí!Àêâô\`ëLn5SØã4ÄÅÊðÙf¬Á2Á¯`¿xKñ!ía8vNN.EÆJ´ßÃÖÊÔ¶«¥"7EBå}¡Q,x<&AzhöÂ^¥ÇT_AJgÆê\aª,ø¥Ó ®åa£¥Êû`Éú3¼/sôÑ_öÂÄWúÂØHF ìö ôÂTÅña.Ñò2PÙ¤/·ÿÄ ( ! 1"2A0Q#BCaqÿÚ ?1¿¡ôòMÛéòðMý.Ê)Aµ"ûS£"þÝ?ÇÓ®]uÙx±½Wtã~èôÇî¯âe qÇÓ ³%.NßD¬IGÜÇ'Uß S'¶¼ßfXS ½¬Q¶fýÇÉgzé9j?»ü hÅ*ÓðK W(Zf8îÉ+dý8ر(îD²^Ú7tÅTkçbÈx«h×F5¦Ey+B\vprc¬~<n^z$Ù麲¢Q^z£ìô$\D³ ìpú½HôÛ=$¾Ls|!åE·ø Ú#6ü1+Qªö9Wr$?IJÿ ¢90±Æ3òdz$Ýè%yWèycú9Ãô¸hâªÇ³ ZuÒ£ "ÉúíG«D²^ìt7 Äþ«¶ËÚvrÕHÛcÿ ¤[äÄîËÑ'jÎiêFH¸Ú=U/ñ§ð¯Áê¨* j"ê6BZd%zéËõ/Luî^:úìj/Á(¸é÷âÔ 2j(ö³÷<pØÌskFHÓ×dY5CìÿÄ ' !12A "Q0BaqRÿÚ ?$¼ëùi.ÆÐϧ»Æ=büiùi?{¡ÈXÆEÖÏIlïGÞ´N夥á VCßcÏ¡IYxdª!+D»gOä±!ßFèI¾}tR,oJÎÙå G°¶D}ÎË3Ë´Q¯SɽãÚ)Ù?o¹Ç$N}£Í!¼Þ(ÉE çÈitfe2¼¥V$äáϧðúõ|Ë0ó.LÒ3oT&¯SÕ¦¼É GDºôÎRÎ~Âùdb iÃö>:V$úr½1!ù_ìP&/ä÷ âؤXï£EÉð8_$¿Ì>'Ó½Ñ nF8ñÀ¡n¥ ئ¾Æ+Üfóþ ¶% #~Itë(TȬ #[Ĭ«1® «»ÖÙ[ÈdV^æKy$Mn®(Ú ì<®HËƸÈNõc ÞIiæ5¹>ÖGi(Ù~Þc?ÿÄ 1 !1 AQ"0aq@¡±2BR#ÁðÑÿÚ ?ÂEÂsP*i¦\=-¢ºæÇI Òé~éÎf[ÊÊ7¤¦»ùÒ9LkE&Ma ;" ®|èê *Õe$ɶ³-;pT u6Ý9¯IűB³¸uLúvÊ ç]t6¬(Ñ ´þ¬©®=ÉGªÜY~=øåEÞ»§§úÑxFº$i¥FêH¬ ÐÒ_j¦².x ºèè@ /U1¥ÕDhÉ0 iª7M%¾Èjºuµ¤Í=4IübCUo¾¨·2B`îº ¾ ¢,E5í\ho¢¤æôÕ#ò" ªiÇÐÕGíãböÆÑÎ"÷öÔfÈÅï Æ%Fa[/ñºß·ÖC´GûÄb>ØGb ^æèдî§çàÐ. qe¿áOÄcGÜé®4ÖA ãTà6Sn×Q#î¥Ùk°NÌ9tÓ0¤ïK¬ßÄIÊ!8ÇOܬ$]"G)³pn«kN2.Û `0kx®D{&ôðRôË%PéUò 7ÙUú¹ Éò¦ö«¡¢w·ýÿ S»UþQl§f å Äì`Ùÿ Jw+UA Ñ"@â~ØF ÌÈþ·º.Äàæ7 ö#^wSæbW BLP_FÂ}5k B.£a\Jó¨ \E«ç;©uO?OYTû ;¨5 Zdu=HêI°²Ìë.¸Þªÿ ]eÒå$Gàú,ßtÀ°ÛÝK^ G+oÍQsOÖÒG¾_¤/ÐÑYßúB>B ¢TÖrÄJ5o©ú ÿ ê#iH·jçdÕJû)ò¦òtU ¦£Ê¨]@"TUSݺélWÝKþÆ·ò¯áï×gºOª¨P/Ù¶ ßÑÓ ê¡·ÜpÒµNÎÙ B ÇáP8s&èÃÞ÷YsA_åË^Csø26ÝAé< )\z;a˽hd]ÖjÓ óÕ½w@ ¯8Q~ÅÔ´;%=éÊ%QÄÒ{pïS\óÒ 0ìæåÜú§NeüO%7æeÎv% O2tÒ6µvËÝz(ÜÛ£:(·Uú "Ò(TætÄHC§7ª !¾NoàÎqª¶Rm¦åeüý-F8xÂÂ1«(Ý ÀLÜ Ôøú 3|cLhñ<hñÄjp²æSÄ«!Ý_C«"ÔßLi7¾j¼ê°D6+ºøË^% ¦#ù*÷LcxìO 4PIåFúÍÔeo¨Nsº? (}Ô´éØÿÄ ( !1AQaq𡱠ÁÑáñ0ÿÚ ?!f K,²åß5 çðK-= 8 ο/µ.wí¸=4 xMÁÉ©gC²bàw?kéÖO^ó7Ðo¥½-e®;¥Þ´ÔËÛ @Ëä¾3`«â³TäS+êüTu9ADV§¹ïpý Ëè R0ß|ÔPÐ-íÐ=å A@?.ó Í»ÇÄ 8è=-¿èkÖ>aiNen(¢éë,´P¯/?Ô ¸ÐÍåÛÚQC]/Ì^:p!®ïç¡lSlï(8XbdÁ(Z¿ïî ÷¡¹o¸ve½Y÷!£i4._É+°qгl ÞB;3$°ëï?ø zd@Aeô¨aV+¡eø¼6E.Rákóÿ &°z2Ù| ýÙIA¸ëè¤=÷M?2ô±zZüzïT"«ïÀvÑó±\ïCC¡ÐéXº !çÌP±EóG«ZnÞY¬wÓña¥¥ð0 BX¯açÞ)q¤$W:¢0, ûÍaåô 6XhMaOù ]£¼Â&FZµ÷ûÁ6ÿ è=8¥Ü+o Ó ¦YÏ=¿2â\yxÌM¥ð%¿ì³S~ ¬5=¦}PÝÝb½=á RÈ×ÍTh¯Ç SáÚÝÂ8Êå{Á4Ôz\¸u0R ï¼¹AE® æ5wg¿],๠ÃæBÕ£cï¡ñÓplh^ Lt õJH uZ¬ÇyÛ¯Tq>ÿ ²©¤!® ×K._à ¡(khp¸0îÆh÷¯½á k.-Öxù¿xEj[ z ô¾ks÷Y¾è9KÆxÇ y³Ï˺ÿ f©¤5ÐÔ]à×EÏWN ÙE÷¨ N}&e_oÇh7ÔL1èàmÝáííPF"ÛU,S T ð.Ë·KrÇ{é î®ð __9 YDÒ¢Rá¹^ð¨¤ãDjüK±q£_{LpÉB/# bËïâõ¿ä9·½Seùàräï>É¥c RÆã:tdAU(Å{Í#´u*\æC¡¯ &$lª@þRªuqê(=JK.ðLs¥JïbÝ6MQ·°q;`Wlñ|ÂI˵G8óÎ&:ôAîÛ¿[Ag½Pè|͹Úî®,×}¡ .T¥{J±A# Û S] /GT¾f²î'gm{pCШM ËKû@ÁBfÞÊ((ÖØDû63éíº3ø*¶öûâ/©'?½¼J9«ÊÅOPîá.{°vWYê+¤ nMüÀõEs£UÇ~#jÏi¬2Ú¬7'Ïlãá ¡ÞYjÍxò¡ æ6jÃÓ D[ia`ªãØâ¢kuǸ1 !=ÜE¾!ëÜçæD<Aè*Bz «%]ï¿Ê\5TY˺ûq\ Lv¸èB£þ,à·ØûýDu `âüüÃ-`q¨RN^)6Õút¨C°rç´ì¤âçm©û*ÌÆÍ/}°îíÜ%ñAè ¨ñ4¸nwߺï*iÃCºr À¿ÑcPÆ© àǽ@¯ý*?Éû ,Õo1ó ¼Ú¦þâÇ»P ÜJµåè ¹|@ ê,Û¿µ3Öñ1´ÊYn Ç@AᾺM¿×SLÑ1»ø0g)zBÉSníÂG¿sæ5³´g`ví;òHX2=ÞÚ -å±[ xÿ ²ü û¾@|ß "Pd ¨Ø³ÛG¦ 8¦âM¡¸uÒmÐÔ7ÓNª8úYr¤ &q4ÀÙåòïº.íx}»nÃdÆ]Ýþñ$»ù^ݾaiP)dzXÆ¥ð6B8â(¿x0jh7 tt#Z1¡ÜÔ¹jWµ q² +EA Ð÷/ïþÅÒqÓݯÌ*¾ch>¶Ãé§AòÞè`¬È æx;`>¬U+»^»>íÁeêË´ã ûsYk¬Úåßë)ZÜâøâ9ù +rÙg- Õýâ]óSYà+^\ÄL ÚûÄ``îXê¢ñ³ è×X°I²sÌi2&2Di>HDÖÝ`= eÁK¨ò¡Æ` *En HO\Í9Á;äß jpR¯>5W99SïϬ¦VâÆ«? U÷0²ÕhÍoª ]ıcQ27OÎ[¸8¸¤çz 5Ç߸\}0ýÞ3 »*/Ñí1ðÁËÏùç&<%¿´±R Ó÷ Ì&[·¬îYgïÓÒ Z9q`,·díwÞ;$*ø´Ö¯çN»B&5(7\}¸*xÈÚТËx0 Rì·ýKk ÁGþ Ñ v1 Ë*î¹±?O¥1_´%üÅÂÍÝÿ QÛ%höÿ Î.3ÿ B;Jö÷L,m%Åa¶ïÖfa¦ ¦±;kzí_Ü2zåwòè¬c 8Û©hø²sÌf ÝÛWúï8NYÿ %çÁný¸®}ækKbN&3/Bhªî(´[QÕKÊ´Ðkû¤]×9\³à§~¶PÛT o ¦Óºâ+» ɹ{ÄmÑ¤Ò \Ðèôôh]]L ªH®;´,Ïû¹R¤ bó¸æ/®qeÀÀ5¼ü{Nö¢y |hc=ã²"«%2÷¸ªñvWEÔ° Ùò7[ßgHLãuj æav¡´/ Ár1M!¨CSH:@¸¥Jþ ;.Z( CQèÏH n³ÄÒhòÄ©ªpã8Ùл&ãî A¦ñ¬½¢X5µéfO Åmy{B wÐPÔ54t1 u©F,Ü\?HãÄÄg¤¡Ã ã í»ûë a¯ÆaEX.>ñQ9V m8ÀgÄÊN fÇCO¹taâ8Öð§y¸9Ö:K£ho¦N¹1>NSk¡À ^;Ë Ì׶7Ðsq&!¥ly©G=Ȧ,ÞüNMS}`FáÉÞ$NgGãÂf;ñ¹T®§Ì · #g Pé¤7Ðèt©/}Ú9ÒRA.Á«kÏrïµþ¥ ¿Û£ 6àÍLÏ ½3n4j@ VÑ2ÑýÃmL sH@Ó`ªe½1Ú§ã·Ô±<^!aö»Çõ@&kR Ýeqt uÿÚ ©¼Å· ×Ýðz ¥¢àu¿ªawdÒøCÉþ&!ôý@6ßMí[T¬D #ÄÅ¥KUÅ;Ð×âBò´fbTÙ5ÚþÂj¼·KÞMÈÖáõc©A Ó*OÙmW°úÁ²Q*C븥iÅñdªýRq¸aÆ%Ñâò Y´Mͤ¶FÚóð÷IÄ£%ÍPQæbàwùZæãCd'Щu2ñÿ B| ~?] ÷ùÿ <ÿÄ ( !1AQð aq¡±Á0ÑáñÿÚ ?ÿ Ø)Oe®zã㯳,_ÏUmù- ~#Z*+%À9õ¿ ϾÏNqo,h ]ïëÉce0ELîûÔ·^S¯ÌøQPÔ¸<_YÙ<TBLÅàþüøçPú´aæQh!ÉÓ ®&9Ñá©Öü÷ß¾`]D¢â0ú´Ðjb®ÉYzCÍÆbßÖæ)Qúãñ<¼Ó=ñë3sÞûô\Fûâ 1UÒG=bs ùI ôÖ¾ø'ÖuE/Á¤&rà qññ.Xâ©Éï[eã±Wí¦Dà I{uZ76µ¤"°+½âô¯û¿â;ø4ÌÇeïÙ¯#Pjá/¾øûEüWñõæêV×HpÊ?Á6Ô^h8vþ~~¥¯Lýw¾Ø_Ìæ3u_ÜG߶¢ ¼ê:FIW¨*¹¾ß´3¡Å±ÌñÁ)Ý_ÌO{'¼³Åm7e È©òÚW¸dêd h¬þ%ée`h¤míWîzCU(Äòì·£öK¨&Ïxj¹ÔÈzLßj]³L«m]ÿ ÏMBË¿©|á¯Wý~E9<øÆð~Á,Tȳ¶pD: WÐxFDë_°9. kÉÿÄ ( !1AQqð a¡±ÁÑáñ0ÿÚ ?´4à-Í«ß¡ p3lm| |G«YR¥{yW¿{ðvü`¸1à k)£*:pêó§ veË . f·wó ÑÁ£o -2ýqKåÅÊXó%Ô6me¬#BÙóç½ae¥jð=PÞiß}`¸àÍJ:Fé4`áÙù×￨¥M\zÍm6 b°õCÉËàZË.X9tÌ 9|CQÒ¼ÝóÔÇ(x8`W¬sÿ %FÎaª9ý09F~Ê ÿ Q²g ¡8#TÉD°ß¾rý½ oSN×\|Áó0ysrëûìÕóý ´fdjãÓ»»¶fºûi [T Å]!½æO ¤ÓÂB áÒhÆÏ=}óE^¦Ðª%{GëßÜC飪ÿ ÚvõÓêÁ4*ù+î«óýNøĸSüµí´ú°B õJÓÏxïÞv½»ÞóÇ¿ì\«ñß}!pV+X)WÞ`V Æ· *ºÍÖþ#/ò9-Ü÷¤¯!ué5m°ôo( õLÓÞ; ßTX±dÖ< ^" zX÷?®ôÐ WÎß©GÌúG3â éöE=cë¬#ª][TðJbÈ%ìJEErC/Ô°<å C0ÛÊTêK"¶¼õ» (síYà*"®~?r¦VË0V&Sx@Ëxß ªzüDvÙ¨A4ðÿ ÿÄ & !1AQaq¡ð±ÁÑáñÿÚ ?P®:PRÀ0{sÞ7IæUáz9Ü6êÐáÀve8Ö@0 cÏ}tÃ(騲ðÏ ~°ä]å|¹= àCU¡B ¿×s6hÑ[9åß÷Ë°ø± ox- °Ú|gX «B f°äÒbUÏ(ZáË ù~=Ø£é¯y¦ø´ýx ¬'Ð hàÚ=®¹È×}*¯hRq ÊÔ§Z#Eº5NÓ!UÑíÎ³ï£ 4¿ ^r8ÃÍ¡@ÿ ÒyW^×}×y1]5O¼5ClKa|^2¥¦(ìòzêOä~ò<#\fÈ:iw8êrzÎ6[º'Ý×Î>LSNÌCmfàÂB·T³N¾$m-P5ZR¿, @<cÃxi wçé,T@B®èraIÌk8&ÍÇçê;àRKñúé§4C¥e㨽'.P \hñãY!¬ï ùaßãñ¹ÿ X'qëçÄ Õºuæ|Ls!L´«[U½róÝÁ³=Ù¡}äöÁÑSæYÇûÒ*;PùùÉÙÍKõJ\ÅDèt8@½ªùÊÙr'«3Vä7ÚM&%Àk½@ ©F.0üÆs|â£ÖOO L Çò «Ë@rX =êäò°¸B¼8ã±/&+ªÏ qç§Àñò¡/.µ@<~4`ñÓñÛðµ? 1 s. wê@" ®÷%j¤ G9pä1¦[¦¢ZO<@XN×Îîi×Ö>&N¯U´XJ®·®,¯N ÖSfQ˨N¯Æ µ(åx mÒMÌ@Q ÍïÆh¬qq+Xõɨ Ü«Ú¡N<¹úêÒ=-¼¼µÀ¡ÄwxÐ ¤¯-äíªjÞlÀ¶ygççy0ÖðDÁ Ïòg#ðãøQ¸4ÖHÄ:YjݽíÊn-_Ö)°mAèßU÷@Ä ¶<(S\3_dðcYI(J~BÁTEjÿ ¿»Î{£6ßxtaÒ_ÜÂÙ¬ pïY¨ 0¸ú`,·Û p_oæ» h z ¼1cáÀ3ßÎ,æ`B¿²QgÐýfõ_,1¤¾»SÀâütl qÍpæ$ß»Zíû`p7ÞnôaÇÏãøT÷ø¦eñù F»¤].µîsÑL(ÑëÆGtÄfDo¤KÁL5hb¼ãî¹¹Úð ÍÌ1Aw67Èøý³O"xËr<ÿ bB#3Æïs j V þøÖñd7ºÑ̦ìÁà1Å<ç¬÷`_y]¢GºÞ5"!" ZêYã ]ºÐé'Nwy⯠*° £ ÜøÁ+Î =§àh8£pi¬uüþ{Àdz§¦aj4Òy× ðs¢Ç\ñ¯.RûÁ9 ?LÙlÞ¯3ûþ1Ó,$áçT!µB6U <ÆOOáÐâ ·ÏÃÉÜGÇ ÃÏ«0K1$ÅWqó¾³bVÕò\ZL7pÎ*kÆ=¼ÇCüò1VÈv¾4sæ~æ¢IÝC®?WÂ4`, àøǤÅJe°GqïY L' 3>f. sA¾ç÷XÔxàF¡ä»<P{@øsÁÎd5TBEjW]k4u/YT!À¦x|Ë£µÉµ*KV¾ûÍXÉËS jí«½)¶Sa?oî¸þðÙ¸æ¼ÌÒkÕP«:Ør+ÀÄV@ä-vh6³XyCnX ? 5LiòÄáïX G é® ¥JºÂÍà¤À/Æ yöC}5 kç²A¤h]3%ýÏàÛ¬F!R _ïXÐÀ4+ÐfÚ£æT#áÊa ¤{kü¯ pÜ¢ÞI1AYc ÁU×k;ÇE H íî wÆÜ >Îð!µæ à¡1X¤¿Þ3Ïlqfn¦ÀßÏM©ªÙÄÐ_X(BwüíßxxÃöÎ,teózÀ<8;ÃØf)ÁúÂ}|ñ¹Á·[Âf Ey6ëÚëÈ" MPV¸yÄ$¦ ñ@ ÂÚrHxÔì$*!í º|1<A!|kË«±ÀºÑ1SÏ 8 ɾ2²_xx[úĦ=§#Màt0"( mzñ[ ®ú¿ï ©Èì9þCôýä ®r bh®N-;"Æy7¥å¿îïXj»Q¿£àwX {poi¬2 qøpÇæ}ä´S¢ñ^°£ ,(Ũïr 7 ó{±ÚxÁaÁ%Ù¦|Æ=Eº¥¨1ì6©½ñy)³ßÙ¤Îw\®Íål@x3cüZ"½LYuMmÑ)&ÆÔ\§";rT ÂñÁ}Ì r ¸D¥wûK¾ù·ýÑíÊRÏ' D}å rç`~ðùÄ(,gUùrÆT¦ À«ðÊa- ®86:yç_µaIôj!¢Ã @½ØHòÊ#E §e6;0dñ"µ !ÀMMï¯9¬ ષ¾£ÁLâæ¡ìËlç½9ì ²Yû 1\ÆÊ;ÄÒT?Iº HÂ4 Øv^C+I*C1v¼ó´¥ *$ ÙÆ *È=ª/LKQv+uîçÛ¨ìÉ8ëQÝæÒ1ÍUÝg¾¾8éeGã8£¢àNwGç ì¥øƳm]9Þü°0Æ;¸ tj£ªÔîMr9`J;éýç0°é|cRDÐ;r¥aÐÂË{TªÛÀ¯bÚ¸ªíýùÅRôC1» è8JrÁz·|+;.¸®|dã ]æëÃ;¼±!ñÆ+mBfPèîüÿ ¹¢A§h/°'º¬ÚkÐòb&wqs]ÀLîàÙïX ¼ «d½¬Ö9\%Ô??Xm<ÉãFu Î[na/ÆñNP ±!ìEô°Ý,¨ %8äbþ©sãç@¡i×TIÃ@XZѹ»º]#Î 4 v # ',F UÇ H"y"ο EEÒO3¾m$ Ð8'õÉ2ëÖùqÓ~Y¸~ð8v!ÿ óÎM,Ðß 6 ñúh !H£Òïno¤få7¢l7Ö-Þ¾¼ÿ ×Îk0Ö)¬ ÙúÎ×; ÖQ¯CÈ·Wð°ÔNÖõxò]c¡ÁË ¢ÑtÄøDONw´çl"s\ð] ®±w3%ÐÉÒ'§ n:JPúPvì½UgÅ#ß¾ X :$UwM$â Lî &§»¡ô hf×A¾\W´ 9 Ò ¹õµdR©U{\¼ M µñDÒ#E*9 ÊÑD®ûÔ¸ iÿ ì÷RÕU¼ÝóiÆ°Î0¹w C¬4 a¢à ü&pç7Çç·ãOÃ@é1*°ÖQ:6ðp£¬#N4Ù¾üq8Áe`°Ðm` \¦ ¨Xä0GËØRÆû?o mþMæÓ¥ßNjoF§¨Þ7|5ÌGe-G0 ½ñ¬Ôè Uµv¼Ð !³m`l?Êb#cÐÙÇî²mAà4{VëDjBF¶úÈ_/8'XZûÁǼÿ àú³ùb,p\Q ÀÐqðñ|¿sð\<~x8Ænä\QcÏ9Q[ßýþܨ< E"SQ©÷aá@5Xj Åçf ¸¨: ÐsÁkLw PZ ®õÅ ,ÝAÓ¦@ØEUÆã+µBN« Ðu OÀ½`kX8$Áã8ÿ u#÷ËÏ7¼O9×öÉéã?S; Ëéç,õJe´ó7Ç4ñ&6£ë]uûX¦Ï?ß÷,Ü©7M;a|¸: B¼®ÕUbR ïk}84JS ó:~Þ¡¢VÆɾËGAÊp^y ê`$`é ( iux $l!8 ¢ atéMè¢=ØK¹Ñ Æi*MB2õ5&¦ÅäRHh£ºÉú©±#Vv-Ò)¯ëmÞ°PJ-¥ËBrí¶èÐNX1 ÿ _¼H]iPÉðGZ]SùÇ0zØiÝÒwàÑ~hºÑ«;>g9Ôí @TÞºS~hô@ÄÝçw]Fò$ÏtÕ> Ýx ñç@VppÚ;¼³õ{Â[> Tb<òs¦/3ª¿ ;×Å˯(÷¿Ýªæë¨ðØA"ëbO?§/?^·øû<à7ä6°?ja´DóÀþ3`&óögÀ¾°p¦ \#ElÁt}þÌ 8 ØÊ:ÓöL Ù(èdä_@¥º>æ²@¢Tyª´QÜíó A+µy»µÑÍÆËIü yôå DGpéz_óÞ÷âÊODå¿Æ"7 #C0ðpÝ&3¬ { Ä9×®jLª ©4Zhxy Ù÷óíH,<Ãn®¯Ì>À*%3H/Hßt?¬¤ sÉb°ð¦ñ±=\P ÿ ÕÁÃÓu+NA²5²G*¥ ]ôT&;Jèy& 5. ¥A çç¬:'`¾Õ d¤À6kÉýe# ¥ §{øãR 0wiG®nظ¨426 EïR½ Ú(û {Pì@ ¦°ÓQ ¡YÁAû1iAJóS©¯=î0kh*ò>¾yþìY6: O¸$ N§+ØÍwrÅkÜ9'ë ¹f¡A%õ¬SFËä?æ,ªð¨»£ûßxÛýófÑÙìv#A)f¼õ¯ÎC0 ±ó°úËÂQ¨²Î B˼êf$>±ÙWfõ¼ï\:¾s9ÍðÍ°?xVùÀ¾\sëÒ{ÁÉè0I¢d¿@|0Uw^s6ÕZ¼óéºÝµXâþÕÛã}ê \AùDlâpvÒ0 °ìíMýa KX BÑ>$¼ [ÐÛËÙ ¥ 9Æb6£öß/§Æ$8B¸ixt { ê«và x0J¡;;| y0{Õxï 99,WÖ*ZÎÊlá»×Ky'ýfVût:?\ Þd#}öuÎmÀ G0 ,X 2bõ5AØ;{ø×ïX<Æϧü·@`ð`$ó;áÀ,{s±ÎçÐ0wà½á_õ}`óñ e>4}Bñ¨3èÐU@tEÐYýÝmI}ùÁâ=ÝHm HÀ1òÄ ¤Sm¦Õ4kÉ`^4 ~°ËÖ=þÉR"+8¦¡@(åxÄuHÙÓëG8Þü óÕ¡¸Ô£78ß'xÀC»Þùÿ _XX»ûÃ198¡xJsLh !èþÿ <`[æÍÄüE_Õ=]ïÛÞh5Hÿ 8hõ Ç1_p|gg ]¹G| ùb-`ðO ðFÑî}dç4cTg8§T-jÞyjqö .µ¼4¢6FÎ9ýf¥v¼¯xÀL°¼éßêjåm1ªÝÝ¥Õ^/É7Çëj @ ûk¦ó Í3h$GV¼#z '÷ÆP³A÷=fÆÃ÷èTxf ¢u³§àìáÀáh@W\ ñL Ò±ÏÑ ôÂNu'f:1Ñß8(úüS0 Öà{ÄÒÔ<RAõÉÙáƨ軨¥ò ]%m È =` ¼Ñÿ ]äUÞDÞ=|+2 3tÙiÏغÒVÓj·Nþr] Ê ª ul%Ã,~K2¼G< w.ç'¼5é?Þÿ y³UÊÀz=â¦T%' p¿x/b(µ´gòg]Hü)P×Kå)ÿ p¢¡¨ú %×ß<cÀ-iaRÈ:áÞ ûÂ㧠&<p|þ@¬ü ᬠÃ!¿CËï$53èÊ¥ÑYÃ~ ú&hæÙà.mÖ:B,½½òäÖÊvÕ÷¿åÎ8´Òüõ qz½7#E¢é¶ õ¸Ø$Gûç çÑËI¸{eë^pDu@=â³ç o¾Þ0 !7>± Ã}ÃèŧÜt çMÑù"D@DDËÚxãvQcH)ºðèãÈøضÁzÞ°³ Ñ2»ìÅJ`Ðàëða5³5·XÏN¸ §÷ï àÈð!!ÏbG ¬ÐH 60j ï{þ;ÃL¯0 ÷ëö[ÂNFq(w¹,D¬ Ãüå?yN 6'#ëUÛ²$¼¾tÍñÍT _ï<lË 8( ïúÄ<ϬnãéÌÔWR2½¿\Ð?Xu«4¼"ÔIKp± Bhõ®Ânö<?§Si >5ÞðüëgQ Ìr~?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 13969 |
| Response Body - size: 13,969 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ {ÅÞá¥{æ\Óbð78öJÙתH*HùÖrϵËéòVÙY1rÉ;¸ô5Ly0×°f× jâ6)Ô#³¤è4hÕvbRÒÞ·=òÚIv.s®No+ƽ)`©(u¡º»IR;âôyÓ¿^©ðv) ©Óê-¬j n(ñsäJS¶u^¡5&fÌfÈI4¶=ùåÜgôS¤±Õ#,ös%~¶ ©ÎäK£¥µeyÓ©kî4î¼ìç ³µ}Yèy¹Þ«ñæÙÈU@è¶ÍM¸XÊf !ÞCÓOhxnWbK¶Ë]ÐX] ë2%ct4µ¼ÐÄ£Ä$i/«=`ö ©¼õ{®ÂºzB×µlÜa¬½ [íY·°ékã|êÒZ&;åKu ;³¹A;Q1ÎméÒLª·IZ5 F[å4 tN ¦¼ÚÄ8@òx]¾RÍì'§~]ÄaتÃÎú:°<#,,ÐǶyÙØ+°EÈÀiÛcÅFÙSåÕ!LãvfëSmÊæ tkÍég!JýÀó@:5aËYì¼n Ìܧ¢dA£Þæ|íqõÎQE/y ß;ë7¨Wkf2àèº&LS¯:] ëÏvsÛåÑKOU®Ô¶µç§ihÀH ´X ¡'=ù¤Õ¦ª¤G©xYGÔíôû¼ ¾2CÅ´æ£Á¶õÈè[íÎ×%´æsRÆÚî=³´ i`8Ô`ãK³íg6¡n{ò è¨ì*,Ìæ¹Õ!ðuz¿ióJ|î»üͼ۪È5èðcÞØ9ö§cRnÓÙÆÚ VfÝ&Ñg'7;.âzFùK·= <½z3ãfçl¹d§}sªZ̧ ¯ËJuæ½ tÖ°úá :'Ð4w2G¢Ùi§3Z¶î4ÀÃÛdÒ uqfòó°áGêÇ=äëÒæVøÍØèuÊÆ>Ã+fÓGE·Áfmm`¼ÞîB ¡Kú ®7ò0Îóy lKw`À"ÑËL ²%g´ß íæ$d\étË5ÇY66×dÛUDÓ]ߨôGW)ät5-1u"+¨°ã«¾¤]']ôó=N&{+MlÞÞ{¼ÂCÃgVOËÌMṳ́¢~dzr<ÆËQaÑÉ1æ+ÜÌÊò?1ioG3qìÌd3Ì 3 !ÌZ¿· 4æ<ÚYYÝd÷ÿÄ ( ! "102AB#CDÿÚ zyTgÚ¹©GMäõß IÇ#Ú¡X.t¶Y ËÆ¥u_m%,ß$?ÊøﺸÈ^3Epë W,l jg«Mä~üw«Ëÿ )xè\hÙu©YMPvAbúé}ê¥|ä£â_;\iS²ªt¿ D{FËáCixÚodòÉTºÅiäOÔzØ«Búie²ß)Ø£DûU k® ) Âá3x4¢ë®/ýRý®,1Íq¤å¹+) Æ9aä]ùy1ÊSq I ÷ªÝ[Ã.×v&]ý|sM.ýS¢ãK'ÚT@_M'f]ÖÙÕÞUTÈ¡ ÷²-ÝØÞ%ìþ>,þµnñsNTÿ CKeêµòô.t¾ÞÝÇä+¯¨!Ö©vÍê©jÒª}pÙù®%,=ZV±.4r,¶]sæ 4õi ü:hË"¤9JµjÒ_¨¼ Í&ÿ ~Í-z«BãIÙæûÕK! ô_MãM'l`^ÙdÜÛ²¸èË#«z´ôe¤eé²-îöWéO ¸Òv íuú+4Ó±+º»/qU½³É½Öü{{ø·|¿3j£4ÍbÒ2ÃI^ÛïGìC {. ±Yc#^ÊÁBãM;º0R¼ùeÖ«¡at¬·ÅÊ¿¿VQò+"| 2gM2fûl[º;~oå \Jx=¹ÓNÇÌ]ÞJÏû>Uw ªT(RT¼«Ç=åî"ô~¹oÿ ß²?½;X.4ÑÍ#æöíeMö¥IJ¸Ø¼r4¬ q¿ ï}>dë®;J(Ñ!ÓºGÍïäÅ\Ø©hHHÁ\®W?#MObØÆI÷å tµÃ?gOQV·ÿ ´ÎÃ?) ¶(kQBBÝ õhâ¼ìå§ézj þoUÛ¯©É6½ñë#1B.P¾¨_UËÇÎéǧT|)%äTÓC%'9B&&&&oó¾ãìI÷Ãge©ö~HW×ñù.SôܤÇç¯Èüȹ%Ùçy åÚ»»E^óçq®pÍ7zÉò!Ûæ}ÒÍ4ÞXÆ> \îûrýJ]µaT|Q>$ÇBêüm Ô9«jr.uÿ óÒiñ¶VÙä8NRTGÆqù)¸NÈ/z¯]!äE¶Ç!¶Ì%¯Q µFo·oûS÷Â?ÓôFhB¹FaÔê*c¿ / ²L¢¿ñ²ß%«]<¹ÉOƵÿ ã§ÆÆÌoG?ñÿ 1[ÃmG] bØ´!\çadªR£ÜèEjåV ÁìQN<Id¿år×Üu%Æ %ÂÌuܤE_D/àÃY<1ÌQÁÛÃôaï©ëpí!Àêâô\`ëLn5SØã4ÄÅÊðÙf¬Á2Á¯`¿xKñ!ía8vNN.EÆJ´ßÃÖÊÔ¶«¥"7EBå}¡Q,x<&AzhöÂ^¥ÇT_AJgÆê\aª,ø¥Ó ®åa£¥Êû`Éú3¼/sôÑ_öÂÄWúÂØHF ìö ôÂTÅña.Ñò2PÙ¤/·ÿÄ ( ! 1"2A0Q#BCaqÿÚ ?1¿¡ôòMÛéòðMý.Ê)Aµ"ûS£"þÝ?ÇÓ®]uÙx±½Wtã~èôÇî¯âe qÇÓ ³%.NßD¬IGÜÇ'Uß S'¶¼ßfXS ½¬Q¶fýÇÉgzé9j?»ü hÅ*ÓðK W(Zf8îÉ+dý8ر(îD²^Ú7tÅTkçbÈx«h×F5¦Ey+B\vprc¬~<n^z$Ù麲¢Q^z£ìô$\D³ ìpú½HôÛ=$¾Ls|!åE·ø Ú#6ü1+Qªö9Wr$?IJÿ ¢90±Æ3òdz$Ýè%yWèycú9Ãô¸hâªÇ³ ZuÒ£ "ÉúíG«D²^ìt7 Äþ«¶ËÚvrÕHÛcÿ ¤[äÄîËÑ'jÎiêFH¸Ú=U/ñ§ð¯Áê¨* j"ê6BZd%zéËõ/Luî^:úìj/Á(¸é÷âÔ 2j(ö³÷<pØÌskFHÓ×dY5CìÿÄ ' !12A "Q0BaqRÿÚ ?$¼ëùi.ÆÐϧ»Æ=büiùi?{¡ÈXÆEÖÏIlïGÞ´N夥á VCßcÏ¡IYxdª!+D»gOä±!ßFèI¾}tR,oJÎÙå G°¶D}ÎË3Ë´Q¯SɽãÚ)Ù?o¹Ç$N}£Í!¼Þ(ÉE çÈitfe2¼¥V$äáϧðúõ|Ë0ó.LÒ3oT&¯SÕ¦¼É GDºôÎRÎ~Âùdb iÃö>:V$úr½1!ù_ìP&/ä÷ âؤXï£EÉð8_$¿Ì>'Ó½Ñ nF8ñÀ¡n¥ ئ¾Æ+Üfóþ ¶% #~Itë(TȬ #[Ĭ«1® «»ÖÙ[ÈdV^æKy$Mn®(Ú ì<®HËƸÈNõc ÞIiæ5¹>ÖGi(Ù~Þc?ÿÄ 1 !1 AQ"0aq@¡±2BR#ÁðÑÿÚ ?ÂEÂsP*i¦\=-¢ºæÇI Òé~éÎf[ÊÊ7¤¦»ùÒ9LkE&Ma ;" ®|èê *Õe$ɶ³-;pT u6Ý9¯IűB³¸uLúvÊ ç]t6¬(Ñ ´þ¬©®=ÉGªÜY~=øåEÞ»§§úÑxFº$i¥FêH¬ ÐÒ_j¦².x ºèè@ /U1¥ÕDhÉ0 iª7M%¾Èjºuµ¤Í=4IübCUo¾¨·2B`îº ¾ ¢,E5í\ho¢¤æôÕ#ò" ªiÇÐÕGíãböÆÑÎ"÷öÔfÈÅï Æ%Fa[/ñºß·ÖC´GûÄb>ØGb ^æèдî§çàÐ. qe¿áOÄcGÜé®4ÖA ãTà6Sn×Q#î¥Ùk°NÌ9tÓ0¤ïK¬ßÄIÊ!8ÇOܬ$]"G)³pn«kN2.Û `0kx®D{&ôðRôË%PéUò 7ÙUú¹ Éò¦ö«¡¢w·ýÿ S»UþQl§f å Äì`Ùÿ Jw+UA Ñ"@â~ØF ÌÈþ·º.Äàæ7 ö#^wSæbW BLP_FÂ}5k B.£a\Jó¨ \E«ç;©uO?OYTû ;¨5 Zdu=HêI°²Ìë.¸Þªÿ ]eÒå$Gàú,ßtÀ°ÛÝK^ G+oÍQsOÖÒG¾_¤/ÐÑYßúB>B ¢TÖrÄJ5o©ú ÿ ê#iH·jçdÕJû)ò¦òtU ¦£Ê¨]@"TUSݺélWÝKþÆ·ò¯áï×gºOª¨P/Ù¶ ßÑÓ ê¡·ÜpÒµNÎÙ B ÇáP8s&èÃÞ÷YsA_åË^Csø26ÝAé< )\z;a˽hd]ÖjÓ óÕ½w@ ¯8Q~ÅÔ´;%=éÊ%QÄÒ{pïS\óÒ 0ìæåÜú§NeüO%7æeÎv% O2tÒ6µvËÝz(ÜÛ£:(·Uú "Ò(TætÄHC§7ª !¾NoàÎqª¶Rm¦åeüý-F8xÂÂ1«(Ý ÀLÜ Ôøú 3|cLhñ<hñÄjp²æSÄ«!Ý_C«"ÔßLi7¾j¼ê°D6+ºøË^% ¦#ù*÷LcxìO 4PIåFúÍÔeo¨Nsº? (}Ô´éØÿÄ ( !1AQaq𡱠ÁÑáñ0ÿÚ ?!f K,²åß5 çðK-= 8 ο/µ.wí¸=4 xMÁÉ©gC²bàw?kéÖO^ó7Ðo¥½-e®;¥Þ´ÔËÛ @Ëä¾3`«â³TäS+êüTu9ADV§¹ïpý Ëè R0ß|ÔPÐ-íÐ=å A@?.ó Í»ÇÄ 8è=-¿èkÖ>aiNen(¢éë,´P¯/?Ô ¸ÐÍåÛÚQC]/Ì^:p!®ïç¡lSlï(8XbdÁ(Z¿ïî ÷¡¹o¸ve½Y÷!£i4._É+°qгl ÞB;3$°ëï?ø zd@Aeô¨aV+¡eø¼6E.Rákóÿ &°z2Ù| ýÙIA¸ëè¤=÷M?2ô±zZüzïT"«ïÀvÑó±\ïCC¡ÐéXº !çÌP±EóG«ZnÞY¬wÓña¥¥ð0 BX¯açÞ)q¤$W:¢0, ûÍaåô 6XhMaOù ]£¼Â&FZµ÷ûÁ6ÿ è=8¥Ü+o Ó ¦YÏ=¿2â\yxÌM¥ð%¿ì³S~ ¬5=¦}PÝÝb½=á RÈ×ÍTh¯Ç SáÚÝÂ8Êå{Á4Ôz\¸u0R ï¼¹AE® æ5wg¿],๠ÃæBÕ£cï¡ñÓplh^ Lt õJH uZ¬ÇyÛ¯Tq>ÿ ²©¤!® ×K._à ¡(khp¸0îÆh÷¯½á k.-Öxù¿xEj[ z ô¾ks÷Y¾è9KÆxÇ y³Ï˺ÿ f©¤5ÐÔ]à×EÏWN ÙE÷¨ N}&e_oÇh7ÔL1èàmÝáííPF"ÛU,S T ð.Ë·KrÇ{é î®ð __9 YDÒ¢Rá¹^ð¨¤ãDjüK±q£_{LpÉB/# bËïâõ¿ä9·½Seùàräï>É¥c RÆã:tdAU(Å{Í#´u*\æC¡¯ &$lª@þRªuqê(=JK.ðLs¥JïbÝ6MQ·°q;`Wlñ|ÂI˵G8óÎ&:ôAîÛ¿[Ag½Pè|͹Úî®,×}¡ .T¥{J±A# Û S] /GT¾f²î'gm{pCШM ËKû@ÁBfÞÊ((ÖØDû63éíº3ø*¶öûâ/©'?½¼J9«ÊÅOPîá.{°vWYê+¤ nMüÀõEs£UÇ~#jÏi¬2Ú¬7'Ïlãá ¡ÞYjÍxò¡ æ6jÃÓ D[ia`ªãØâ¢kuǸ1 !=ÜE¾!ëÜçæD<Aè*Bz «%]ï¿Ê\5TY˺ûq\ Lv¸èB£þ,à·ØûýDu `âüüÃ-`q¨RN^)6Õút¨C°rç´ì¤âçm©û*ÌÆÍ/}°îíÜ%ñAè ¨ñ4¸nwߺï*iÃCºr À¿ÑcPÆ© àǽ@¯ý*?Éû ,Õo1ó ¼Ú¦þâÇ»P ÜJµåè ¹|@ ê,Û¿µ3Öñ1´ÊYn Ç@AᾺM¿×SLÑ1»ø0g)zBÉSníÂG¿sæ5³´g`ví;òHX2=ÞÚ -å±[ xÿ ²ü û¾@|ß "Pd ¨Ø³ÛG¦ 8¦âM¡¸uÒmÐÔ7ÓNª8úYr¤ &q4ÀÙåòïº.íx}»nÃdÆ]Ýþñ$»ù^ݾaiP)dzXÆ¥ð6B8â(¿x0jh7 tt#Z1¡ÜÔ¹jWµ q² +EA Ð÷/ïþÅÒqÓݯÌ*¾ch>¶Ãé§AòÞè`¬È æx;`>¬U+»^»>íÁeêË´ã ûsYk¬Úåßë)ZÜâøâ9ù +rÙg- Õýâ]óSYà+^\ÄL ÚûÄ``îXê¢ñ³ è×X°I²sÌi2&2Di>HDÖÝ`= eÁK¨ò¡Æ` *En HO\Í9Á;äß jpR¯>5W99SïϬ¦VâÆ«? U÷0²ÕhÍoª ]ıcQ27OÎ[¸8¸¤çz 5Ç߸\}0ýÞ3 »*/Ñí1ðÁËÏùç&<%¿´±R Ó÷ Ì&[·¬îYgïÓÒ Z9q`,·díwÞ;$*ø´Ö¯çN»B&5(7\}¸*xÈÚТËx0 Rì·ýKk ÁGþ Ñ v1 Ë*î¹±?O¥1_´%üÅÂÍÝÿ QÛ%höÿ Î.3ÿ B;Jö÷L,m%Åa¶ïÖfa¦ ¦±;kzí_Ü2zåwòè¬c 8Û©hø²sÌf ÝÛWúï8NYÿ %çÁný¸®}ækKbN&3/Bhªî(´[QÕKÊ´Ðkû¤]×9\³à§~¶PÛT o ¦Óºâ+» ɹ{ÄmÑ¤Ò \Ðèôôh]]L ªH®;´,Ïû¹R¤ bó¸æ/®qeÀÀ5¼ü{Nö¢y |hc=ã²"«%2÷¸ªñvWEÔ° Ùò7[ßgHLãuj æav¡´/ Ár1M!¨CSH:@¸¥Jþ ;.Z( CQèÏH n³ÄÒhòÄ©ªpã8Ùл&ãî A¦ñ¬½¢X5µéfO Åmy{B wÐPÔ54t1 u©F,Ü\?HãÄÄg¤¡Ã ã í»ûë a¯ÆaEX.>ñQ9V m8ÀgÄÊN fÇCO¹taâ8Öð§y¸9Ö:K£ho¦N¹1>NSk¡À ^;Ë Ì׶7Ðsq&!¥ly©G=Ȧ,ÞüNMS}`FáÉÞ$NgGãÂf;ñ¹T®§Ì · #g Pé¤7Ðèt©/}Ú9ÒRA.Á«kÏrïµþ¥ ¿Û£ 6àÍLÏ ½3n4j@ VÑ2ÑýÃmL sH@Ó`ªe½1Ú§ã·Ô±<^!aö»Çõ@&kR Ýeqt uÿÚ ©¼Å· ×Ýðz ¥¢àu¿ªawdÒøCÉþ&!ôý@6ßMí[T¬D #ÄÅ¥KUÅ;Ð×âBò´fbTÙ5ÚþÂj¼·KÞMÈÖáõc©A Ó*OÙmW°úÁ²Q*C븥iÅñdªýRq¸aÆ%Ñâò Y´Mͤ¶FÚóð÷IÄ£%ÍPQæbàwùZæãCd'Щu2ñÿ B| ~?] ÷ùÿ <ÿÄ ( !1AQð aq¡±Á0ÑáñÿÚ ?ÿ Ø)Oe®zã㯳,_ÏUmù- ~#Z*+%À9õ¿ ϾÏNqo,h ]ïëÉce0ELîûÔ·^S¯ÌøQPÔ¸<_YÙ<TBLÅàþüøçPú´aæQh!ÉÓ ®&9Ñá©Öü÷ß¾`]D¢â0ú´Ðjb®ÉYzCÍÆbßÖæ)Qúãñ<¼Ó=ñë3sÞûô\Fûâ 1UÒG=bs ùI ôÖ¾ø'ÖuE/Á¤&rà qññ.Xâ©Éï[eã±Wí¦Dà I{uZ76µ¤"°+½âô¯û¿â;ø4ÌÇeïÙ¯#Pjá/¾øûEüWñõæêV×HpÊ?Á6Ô^h8vþ~~¥¯Lýw¾Ø_Ìæ3u_ÜG߶¢ ¼ê:FIW¨*¹¾ß´3¡Å±ÌñÁ)Ý_ÌO{'¼³Åm7e È©òÚW¸dêd h¬þ%ée`h¤míWîzCU(Äòì·£öK¨&Ïxj¹ÔÈzLßj]³L«m]ÿ ÏMBË¿©|á¯Wý~E9<øÆð~Á,Tȳ¶pD: WÐxFDë_°9. kÉÿÄ ( !1AQqð a¡±ÁÑáñ0ÿÚ ?´4à-Í«ß¡ p3lm| |G«YR¥{yW¿{ðvü`¸1à k)£*:pêó§ veË . f·wó ÑÁ£o -2ýqKåÅÊXó%Ô6me¬#BÙóç½ae¥jð=PÞiß}`¸àÍJ:Fé4`áÙù×￨¥M\zÍm6 b°õCÉËàZË.X9tÌ 9|CQÒ¼ÝóÔÇ(x8`W¬sÿ %FÎaª9ý09F~Ê ÿ Q²g ¡8#TÉD°ß¾rý½ oSN×\|Áó0ysrëûìÕóý ´fdjãÓ»»¶fºûi [T Å]!½æO ¤ÓÂB áÒhÆÏ=}óE^¦Ðª%{GëßÜC飪ÿ ÚvõÓêÁ4*ù+î«óýNøĸSüµí´ú°B õJÓÏxïÞv½»ÞóÇ¿ì\«ñß}!pV+X)WÞ`V Æ· *ºÍÖþ#/ò9-Ü÷¤¯!ué5m°ôo( õLÓÞ; ßTX±dÖ< ^" zX÷?®ôÐ WÎß©GÌúG3â éöE=cë¬#ª][TðJbÈ%ìJEErC/Ô°<å C0ÛÊTêK"¶¼õ» (síYà*"®~?r¦VË0V&Sx@Ëxß ªzüDvÙ¨A4ðÿ ÿÄ & !1AQaq¡ð±ÁÑáñÿÚ ?P®:PRÀ0{sÞ7IæUáz9Ü6êÐáÀve8Ö@0 cÏ}tÃ(騲ðÏ ~°ä]å|¹= àCU¡B ¿×s6hÑ[9åß÷Ë°ø± ox- °Ú|gX «B f°äÒbUÏ(ZáË ù~=Ø£é¯y¦ø´ýx ¬'Ð hàÚ=®¹È×}*¯hRq ÊÔ§Z#Eº5NÓ!UÑíÎ³ï£ 4¿ ^r8ÃÍ¡@ÿ ÒyW^×}×y1]5O¼5ClKa|^2¥¦(ìòzêOä~ò<#\fÈ:iw8êrzÎ6[º'Ý×Î>LSNÌCmfàÂB·T³N¾$m-P5ZR¿, @<cÃxi wçé,T@B®èraIÌk8&ÍÇçê;àRKñúé§4C¥e㨽'.P \hñãY!¬ï ùaßãñ¹ÿ X'qëçÄ Õºuæ|Ls!L´«[U½róÝÁ³=Ù¡}äöÁÑSæYÇûÒ*;PùùÉÙÍKõJ\ÅDèt8@½ªùÊÙr'«3Vä7ÚM&%Àk½@ ©F.0üÆs|â£ÖOO L Çò «Ë@rX =êäò°¸B¼8ã±/&+ªÏ qç§Àñò¡/.µ@<~4`ñÓñÛðµ? 1 s. wê@" ®÷%j¤ G9pä1¦[¦¢ZO<@XN×Îîi×Ö>&N¯U´XJ®·®,¯N ÖSfQ˨N¯Æ µ(åx mÒMÌ@Q ÍïÆh¬qq+Xõɨ Ü«Ú¡N<¹úêÒ=-¼¼µÀ¡ÄwxÐ ¤¯-äíªjÞlÀ¶ygççy0ÖðDÁ Ïòg#ðãøQ¸4ÖHÄ:YjݽíÊn-_Ö)°mAèßU÷@Ä ¶<(S\3_dðcYI(J~BÁTEjÿ ¿»Î{£6ßxtaÒ_ÜÂÙ¬ pïY¨ 0¸ú`,·Û p_oæ» h z ¼1cáÀ3ßÎ,æ`B¿²QgÐýfõ_,1¤¾»SÀâütl qÍpæ$ß»Zíû`p7ÞnôaÇÏãøT÷ø¦eñù F»¤].µîsÑL(ÑëÆGtÄfDo¤KÁL5hb¼ãî¹¹Úð ÍÌ1Aw67Èøý³O"xËr<ÿ bB#3Æïs j V þøÖñd7ºÑ̦ìÁà1Å<ç¬÷`_y]¢GºÞ5"!" ZêYã ]ºÐé'Nwy⯠*° £ ÜøÁ+Î =§àh8£pi¬uüþ{Àdz§¦aj4Òy× ðs¢Ç\ñ¯.RûÁ9 ?LÙlÞ¯3ûþ1Ó,$áçT!µB6U <ÆOOáÐâ ·ÏÃÉÜGÇ ÃÏ«0K1$ÅWqó¾³bVÕò\ZL7pÎ*kÆ=¼ÇCüò1VÈv¾4sæ~æ¢IÝC®?WÂ4`, àøǤÅJe°GqïY L' 3>f. sA¾ç÷XÔxàF¡ä»<P{@øsÁÎd5TBEjW]k4u/YT!À¦x|Ë£µÉµ*KV¾ûÍXÉËS jí«½)¶Sa?oî¸þðÙ¸æ¼ÌÒkÕP«:Ør+ÀÄV@ä-vh6³XyCnX ? 5LiòÄáïX G é® ¥JºÂÍà¤À/Æ yöC}5 kç²A¤h]3%ýÏàÛ¬F!R _ïXÐÀ4+ÐfÚ£æT#áÊa ¤{kü¯ pÜ¢ÞI1AYc ÁU×k;ÇE H íî wÆÜ >Îð!µæ à¡1X¤¿Þ3Ïlqfn¦ÀßÏM©ªÙÄÐ_X(BwüíßxxÃöÎ,teózÀ<8;ÃØf)ÁúÂ}|ñ¹Á·[Âf Ey6ëÚëÈ" MPV¸yÄ$¦ ñ@ ÂÚrHxÔì$*!í º|1<A!|kË«±ÀºÑ1SÏ 8 ɾ2²_xx[úĦ=§#Màt0"( mzñ[ ®ú¿ï ©Èì9þCôýä ®r bh®N-;"Æy7¥å¿îïXj»Q¿£àwX {poi¬2 qøpÇæ}ä´S¢ñ^°£ ,(Ũïr 7 ó{±ÚxÁaÁ%Ù¦|Æ=Eº¥¨1ì6©½ñy)³ßÙ¤Îw\®Íål@x3cüZ"½LYuMmÑ)&ÆÔ\§";rT ÂñÁ}Ì r ¸D¥wûK¾ù·ýÑíÊRÏ' D}å rç`~ðùÄ(,gUùrÆT¦ À«ðÊa- ®86:yç_µaIôj!¢Ã @½ØHòÊ#E §e6;0dñ"µ !ÀMMï¯9¬ ષ¾£ÁLâæ¡ìËlç½9ì ²Yû 1\ÆÊ;ÄÒT?Iº HÂ4 Øv^C+I*C1v¼ó´¥ *$ ÙÆ *È=ª/LKQv+uîçÛ¨ìÉ8ëQÝæÒ1ÍUÝg¾¾8éeGã8£¢àNwGç ì¥øƳm]9Þü°0Æ;¸ tj£ªÔîMr9`J;éýç0°é|cRDÐ;r¥aÐÂË{TªÛÀ¯bÚ¸ªíýùÅRôC1» è8JrÁz·|+;.¸®|dã ]æëÃ;¼±!ñÆ+mBfPèîüÿ ¹¢A§h/°'º¬ÚkÐòb&wqs]ÀLîàÙïX ¼ «d½¬Ö9\%Ô??Xm<ÉãFu Î[na/ÆñNP ±!ìEô°Ý,¨ %8äbþ©sãç@¡i×TIÃ@XZѹ»º]#Î 4 v # ',F UÇ H"y"ο EEÒO3¾m$ Ð8'õÉ2ëÖùqÓ~Y¸~ð8v!ÿ óÎM,Ðß 6 ñúh !H£Òïno¤få7¢l7Ö-Þ¾¼ÿ ×Îk0Ö)¬ ÙúÎ×; ÖQ¯CÈ·Wð°ÔNÖõxò]c¡ÁË ¢ÑtÄøDONw´çl"s\ð] ®±w3%ÐÉÒ'§ n:JPúPvì½UgÅ#ß¾ X :$UwM$â Lî &§»¡ô hf×A¾\W´ 9 Ò ¹õµdR©U{\¼ M µñDÒ#E*9 ÊÑD®ûÔ¸ iÿ ì÷RÕU¼ÝóiÆ°Î0¹w C¬4 a¢à ü&pç7Çç·ãOÃ@é1*°ÖQ:6ðp£¬#N4Ù¾üq8Áe`°Ðm` \¦ ¨Xä0GËØRÆû?o mþMæÓ¥ßNjoF§¨Þ7|5ÌGe-G0 ½ñ¬Ôè Uµv¼Ð !³m`l?Êb#cÐÙÇî²mAà4{VëDjBF¶úÈ_/8'XZûÁǼÿ àú³ùb,p\Q ÀÐqðñ|¿sð\<~x8Ænä\QcÏ9Q[ßýþܨ< E"SQ©÷aá@5Xj Åçf ¸¨: ÐsÁkLw PZ ®õÅ ,ÝAÓ¦@ØEUÆã+µBN« Ðu OÀ½`kX8$Áã8ÿ u#÷ËÏ7¼O9×öÉéã?S; Ëéç,õJe´ó7Ç4ñ&6£ë]uûX¦Ï?ß÷,Ü©7M;a|¸: B¼®ÕUbR ïk}84JS ó:~Þ¡¢VÆɾËGAÊp^y ê`$`é ( iux $l!8 ¢ atéMè¢=ØK¹Ñ Æi*MB2õ5&¦ÅäRHh£ºÉú©±#Vv-Ò)¯ëmÞ°PJ-¥ËBrí¶èÐNX1 ÿ _¼H]iPÉðGZ]SùÇ0zØiÝÒwàÑ~hºÑ«;>g9Ôí @TÞºS~hô@ÄÝçw]Fò$ÏtÕ> Ýx ñç@VppÚ;¼³õ{Â[> Tb<òs¦/3ª¿ ;×Å˯(÷¿Ýªæë¨ðØA"ëbO?§/?^·øû<à7ä6°?ja´DóÀþ3`&óögÀ¾°p¦ \#ElÁt}þÌ 8 ØÊ:ÓöL Ù(èdä_@¥º>æ²@¢Tyª´QÜíó A+µy»µÑÍÆËIü yôå DGpéz_óÞ÷âÊODå¿Æ"7 #C0ðpÝ&3¬ { Ä9×®jLª ©4Zhxy Ù÷óíH,<Ãn®¯Ì>À*%3H/Hßt?¬¤ sÉb°ð¦ñ±=\P ÿ ÕÁÃÓu+NA²5²G*¥ ]ôT&;Jèy& 5. ¥A çç¬:'`¾Õ d¤À6kÉýe# ¥ §{øãR 0wiG®nظ¨426 EïR½ Ú(û {Pì@ ¦°ÓQ ¡YÁAû1iAJóS©¯=î0kh*ò>¾yþìY6: O¸$ N§+ØÍwrÅkÜ9'ë ¹f¡A%õ¬SFËä?æ,ªð¨»£ûßxÛýófÑÙìv#A)f¼õ¯ÎC0 ±ó°úËÂQ¨²Î B˼êf$>±ÙWfõ¼ï\:¾s9ÍðÍ°?xVùÀ¾\sëÒ{ÁÉè0I¢d¿@|0Uw^s6ÕZ¼óéºÝµXâþÕÛã}ê \AùDlâpvÒ0 °ìíMýa KX BÑ>$¼ [ÐÛËÙ ¥ 9Æb6£öß/§Æ$8B¸ixt { ê«và x0J¡;;| y0{Õxï 99,WÖ*ZÎÊlá»×Ky'ýfVût:?\ Þd#}öuÎmÀ G0 ,X 2bõ5AØ;{ø×ïX<Æϧü·@`ð`$ó;áÀ,{s±ÎçÐ0wà½á_õ}`óñ e>4}Bñ¨3èÐU@tEÐYýÝmI}ùÁâ=ÝHm HÀ1òÄ ¤Sm¦Õ4kÉ`^4 ~°ËÖ=þÉR"+8¦¡@(åxÄuHÙÓëG8Þü óÕ¡¸Ô£78ß'xÀC»Þùÿ _XX»ûÃ198¡xJsLh !èþÿ <`[æÍÄüE_Õ=]ïÛÞh5Hÿ 8hõ Ç1_p|gg ]¹G| ùb-`ðO ðFÑî}dç4cTg8§T-jÞyjqö .µ¼4¢6FÎ9ýf¥v¼¯xÀL°¼éßêjåm1ªÝÝ¥Õ^/É7Çëj @ ûk¦ó Í3h$GV¼#z '÷ÆP³A÷=fÆÃ÷èTxf ¢u³§àìáÀáh@W\ ñL Ò±ÏÑ ôÂNu'f:1Ñß8(úüS0 Öà{ÄÒÔ<RAõÉÙáƨ軨¥ò ]%m È =` ¼Ñÿ ]äUÞDÞ=|+2 3tÙiÏغÒVÓj·Nþr] Ê ª ul%Ã,~K2¼G< w.ç'¼5é?Þÿ y³UÊÀz=â¦T%' p¿x/b(µ´gòg]Hü)P×Kå)ÿ p¢¡¨ú %×ß<cÀ-iaRÈ:áÞ ûÂ㧠&<p|þ@¬ü ᬠÃ!¿CËï$53èÊ¥ÑYÃ~ ú&hæÙà.mÖ:B,½½òäÖÊvÕ÷¿åÎ8´Òüõ qz½7#E¢é¶ õ¸Ø$Gûç çÑËI¸{eë^pDu@=â³ç o¾Þ0 !7>± Ã}ÃèŧÜt çMÑù"D@DDËÚxãvQcH)ºðèãÈøضÁzÞ°³ Ñ2»ìÅJ`Ðàëða5³5·XÏN¸ §÷ï àÈð!!ÏbG ¬ÐH 60j ï{þ;ÃL¯0 ÷ëö[ÂNFq(w¹,D¬ Ãüå?yN 6'#ëUÛ²$¼¾tÍñÍT _ï<lË 8( ïúÄ<ϬnãéÌÔWR2½¿\Ð?Xu«4¼"ÔIKp± Bhõ®Ânö<?§Si >5ÞðüëgQ Ìr~?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14228 |
| Response Body - size: 14,228 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ùóN÷¨Ãp` h5MM À ÀO ðÐ0Ð3á `C ÌÐy&£ ¦è(À(À(À) ðÔÒy0Ðxn¸áJ<üÅQ\ MM `jxnµÚXà½(*+b:ÇB°Ý Ýê~|«<N5s:§È:ÇUr é+òó´°âóÕ?iÎk½ ëÓ²cÛLñN8FÚÖsã\®=b³7ÉJú »¥ÕÊòÏçéÞ âì9 ÐqXu!ID[czιer6´qc=È´:7¿#Ùѹ*%Asíà§6b*çW8u½¼© 1:çºr7CICZUÒwN½eo"Ì·.Y`ÉÛ ù%×Ëï;ZÐÕÊÕ¬ªg ó³hë49¯×ºi_G¯£ëJÍ¥Q«MzÇ.ÎH÷¤©]üÍÔ1)*ÙAÓO¾7µâäç|§Ô|Õó6{Ü<ÝÍñÅÚ=)*Y¯:Yɪ¶Çò¾GWçö~+G¿YÒ5zæyÐ^T·×F ¼_ÂÉÍù¿øµçêôùkÏRRtÏèÝæò®øg&ÔÙµ@çå%°Ëfûϼ¥zm~G]nJ¾aC+ñ4¥Øm«éôìJÅåôf*¶ (ç DW¡ÜWwIͽòÊÈ%a1×LI«vwX]ÊÎC£ xj$ç¶å«L±ubÍÒÅo:ºcÊF¥¼¤&Bz (ßNf{yM*éë+ήYÍaE}²}ÃÃÐ ºµ_3úë$hlR;é~^bçÖttstvKÉñjª*Ãsjj¿¯Ë<RxtCcQ:gç|ò¯ ¤¯%p@ÈutÀ5\lüijUSÕEÅ6Ì`²=;ÌK ¶JJç8Xê¤té¦ÂèS£åë,M³}iÍÚO2 0z``=ÌLÓé´À4À7 Ea@a@qFM³î ÜP ð Ì ) ÿ ÿÄ * ! "120#@BA`pÿÚ ÿ Í+ù8<BþJuZü¿V T¯0µ+d-ÈX`) ^uBã\Q) nµà ÙÉj¨WP#xã©¥Åö ãì °<{e#¾æFc;Èç[v+ÝÂhqo ª«e ÓS.CÔ>±þþèáj'U:N®Ç?SábÑ"Gdö²HɲäÎF")¨¿L½í¨Hâ,ë½Àn}ß}¶ ËO¯=¾ãP¸ýËUê]¯ÀDvà @¥N#âGî` °Ù®5¦7榢®Ú²äemÂWµÚÑäÆûWEW°ÀñÉê ÿ .q¬®ü!*¤JÐ%Xú·´ã¢ ¬S¤ öQì8¼+ ¶â5*(Ý´`Ü®è9 îÂPJº"@Àv»/)Öõ N£.Cøî«æ¶ nû.TAò_Èul2cêr£`Ëóbcìa=Áqp]u¹þ ©Ê_¢ê~tb# ÞÙj!b¿ÀÙ:vVFüN#1öjºî ûúÊ~CEÍedC ¥ªWE7=Î?Ëb.[ãTàé¾Eäj0¯ _U¸ ÜáÊ9( ëu°ÛV!Dn\U cÑÖõä¢=hû j] mòE¦cz¢Àp¡@ E{,Æÿ "ÜK¾Eå`Î_Ô$v¸[|µrü]®êþ5ÈáC4&z[µÎfï¸Ö\±ØÜ'# =ÄQ v±ÀlØDÔøÚ¸þåéÎÉäÐʺ'°ûâ ÷ ©R£¥{K2AìµêGp U/²þ· svâüQÇÝHnËí2®QÖ0̸çÈÃbøïúN« K?Ø_P!ñ¸}Â{8fÆÅaxíá÷ NW ´ 1Û5ø¤_î%LmÆrÓj îvZ¼WéÇdútÎPd3W@yÜcÉ/W9 0f.à 9K^Dù?r=§û¡41G±c\¿ÅûÐþ g)v j\¿ûßÿÄ / !1"A Qa#Bqð02¡ÿÚ ?¿u«WíµjÕ«÷Zµ~ËVZµjÕ«VZ´\Áºl¡ÂÂZ´\ÖßÙC_ÊõQVíZµ6@ Ç<´7ÏótÜ°åê¨Ó ûQd Jy ÷ÚÈ}ð¢Ê2>5ïb*ÇËÖ7Z\Ó¥ÌhÎõ3Úý~·B|®¤±¹£ý¨r(°@M1{¼)È#Kê!7Wu64¼øþ}V©"qul¥ÆÑÝ#Xß×Ô¤¦Ì ¹äð£ÆgW°~èÀÐ8Y )ËOMü©5´®°s÷;'æýEG5I<©atG\i³ º5(§Ú.L À3´ìÐQËû§Üëg*Ièß]mj Èe³ÂüE¤B9Ñ *W2A²cÁ^´ZĸìW®Ðâý'æ´rÊcü©¶îb$r£ÊÝbËmíÙGñæHç ©Ï*~ ·Pkáe61 ßá`]nf¡ªfÄçè¡d] ¾ wÙcùåH<©ºcûJÙÒî[XÖ#u©DÖiíR Áºö´) ³J,KÝC,ÒÔÜ4näì6ù*H£lÑ59zMÖ xMÄ{çVÿ /(á°sº t°n¥É Tx= x³äìiO/SeYÒÎTXÚSX Ä&C[y 9Ø%¦#(!OÖþê8L§¨õ3;Ú@kÒ|ªÐ/õ Í´÷ ¦È.:#å3 @û¨¢ê¨¢í×ôåFD/Óà«T8Í-*`è$j*);£}¹ n»V> hYQ<&ÉîYÒle æî¿2Rßú Æ6j²W4©GK½ »§çt|© 4Î1ªTm;¥6&ÄÂ¥H²Ô!×÷Qc@ð¤iA©R©¿ÑºO®ÝÂôÎsµ<¦ÄDz*Uó¥J*T©iT©R¯xT«úóÿÄ $ !1A QPa"ÿÚ ?ýUWùQ³ÁEp²3í} è¢c-*Þ(¡éþÉÉÚÑ|] ú2(¡ª:èlLNÊ1 N:2Ó$ElzÑÇ´bCb%C0© «,?Éé\ýÒFÄ*òO SÌxli ©ÉBÑé%/p´;±phÆôB mfBt&w¶{JÆü$YÙÇì#Oe£%ÅdV»,LËCØÐeC߲űi³h²ÈðSmbÇÞ¸²Ç´-öEJÚ} oáfEÍÊQ þ§ÿÄ 6 !1A "Qaq02¡B±ÁÑáðb#@R`pñÿÚ ?ÿ ؤþ^÷+ }Ô½üÕá²²LàªÜg#1îLp÷¢¨ Ý.Ôd À*÷¦J³kâ$ ¤G ªö|µW8CÙÄi 'Ôê¡¡P0¾ájcD6nwS¬ñÍÕ(tÝi¼f8±åImà¡Òµ`i!®PuäéP¨;²Çf6dµß¿öT-øG©íò ÝDdÆU¶%Ð:X o~Ïõâk¬Ð¸«" h[}¥ F §1'ÐÉ.YÑYu}wqk}× úöF⨡ 7¿ºbQ÷Äc~CC{aNò¯×wF;©Eĺ0«6 ¦ñ27exV~ÑÍ »£0 ê'wV$ ºa ÁЩ@hUºµ*+$£S<ÀE.®N/;³òÞ8u¹S"¹ÝYÜKt$,FêXæ ºÌèOci¢ú}lh¼¯^ë¿9Í"QÑN0L ÕªµÙe_$ ¨'^ è6ã=&Áì @wâòÅ«¿.ß}>K+¦f>,xdOä²¾|ÕºLöÊ;7üQmÇmM§ÓõNë#EÂÖôB1Ù|.twD\M!=¢í'IRèÕ_<-¶öeî=ÝD;ººX(ÈÕï¶p« ¨jwN«£¦4Óè2Fª6} aaoÌ"\óüE»gïâFe&'Ç)о"ÏÏi³sL0~H3dû ê§Ã¬yAÂ">ë_E$åïr´AN¡þ+ýÆbê .$ßáqÊl¦æ\ªôVPêE Dá §ê¤m ´ád@ Åí84?%®´£ °È=T}UméiÛB ZëÙ\,Sv]q~ª Y^` ×HMcõ\@½ÜÕ ú®<X(¹ÏëáÃ'ÍJ¾YÁÒ4ZÉ6F+Oo Ey)Ìiù \O¦[¥ÿ ú;U®V~¡tºá\$v_¢z z@4Ï_²0>9³»²ü$ùV@]B) ~ÈÍÍ '¿T¤áqXnÃg§M 0z³góC¦5R pÂ5ß>P1 Ý5ïÉ0=ïªiu VÞÙË÷ª¹¿Ë²Ð ʳ~¨Hú# 4Ö0@ ýZÈ! ªÅÖJ.3Õ PV« < ÝZÒ̯åz##*¸FëÂ*ÓÌód æ wdÎT,Ȫ_åÍ"ûÅ£éÞ#¾àayWÈfȸ]C;ó?¢µ#Uä'5ÂCIð´ÞâFï²t]¼ªådÙê«|» [¸x´Ç³hÝÀfàyC"+%qí ÂÙBh(1w* v9ü·¸ÉÐwO`lEü¿°«â@pî¸rP{H{¿Âhu,ÇHÝEJÙµñ/1Ûûü©dp_² åµä®W_4@ÿ o:¡ÕõNvª2±Ë êFW+fó<Lù©Ä(n9p*÷8[?i'ÌJ/¢qÚ7h')£Ã«ðêµ×ÜdOw}á:Èâ ÓjU¢oÓÜD8²x9n«ÑACöWÿ Ô ÷ ÉP1ÿ ÿÄ * !1AQaqð¡±Ñ Á0áñP@ÿÚ ?!ÿ Jÿ Ë©R¿ójWþ]J*Wñ©_Æ¥Jü*T¯ðT¨°ÈÊÿ \âë½3[u¨À<2¥JúWòÑÍQþ2Iïqt¥\©n¾*T¨Ò-æ2Ýn@E !Ü}~ÐpèÅU¯:(±Í1¤¯âiwÝâ·UèmjúØ4ÿ UãåUhôÈàhN¬`û ¤b¥ ¨Æk ýDÝÙk× >©z#eÖ ¶Ñ®Lÿ ¦8£JéÇ_^Î â8{{þ¥$ª³¦"¨ÒrT¯àdËA{Ä´ãí0§ R© l¾3K¸]yMú|¹ÚMÏÞU í¥°7\iÒ¡¯Ü©R¾·è½Ä -:~}⣰ÂXò«Q18NõæjV½²] !ÇÎÜjdPÞu]\Ï8öAtk[+Ì¡©R¡LÐqurÃÉÓè .ªþu%9ÃZØY¬g1YÔ«þ]~Ù¹mîÿ ¯l0 ðatýµÐmªéį LµÄb¦l\Q= -Ûbç xÜ XÇlÅÄ- ~zÎÓ_Äy*üEÐ]ï¢}@ØÕ.ëþÿ ©) k¸?E#élü;DÎñ~¼¼Ü`9§ þ¥Ø!ÕûÚN½5¾h i²µí<'T@óÓ S úå(¤g´s§Ü®Û=Ò!gN¥<ú½±ÁYqÅCkAà'^%@5t^¿oêdÊó%è¬ ØJí Pê×Ypa [[ÃQ+T¹ÅâÏù ÜßIP#Kv¼wñÇ=åLcCUÞPâþçá"ö+¨,¸1CL¼øv1ÚTåߧ¼`f`P·dNeÑ*6g¿F/0É®eµuséùûtERÐ6;õûcÚ òTXÈù°)ÖfëÒ¥âë ¶+äý}D!Õ*& ⣦X<>lí¹Bp¥6Ðï¯6ú%P)mà7ÕÜ4'\tF£´²¬Ë¥;Kà1õàB F[ Óì¦Y%!Y~ó7_luíä`Ug'>Ó^WgîþÑ¢ÿ æ(gÐ!±N· zíÏbvýLJ@Í_}@ÙTlEìTjdn J5=u/4x(C}>°T«ikeà}}%tâ]{MK{J() bI6 k¿Æ"gÐóý0§4éÀuþã|-*¯Üºùä,Ö£5«iJ#7Wn}æZô4ÊåR¬¹ºûMF¥ik²Îæ2u2f £\í¨ÄÎ5gnÿ Ü AêJ¶K`v׸ÁKµ¾9ô;þG B©Tx h'Ëé ¨ÓZÌ ©ÂáÅu õéħ»©W^OF¢ áÓ JÆ0e ¦^MGªëÞYß\T~o.E¹ ¯(¬ ?®?¹vÔ8»^·/4_-ã}³~зºÊMôcêóþÍB¦Îò)Ì©ãb´*è }içæ%ìi ª9âPb.]g½å °2'V¶(þ¢[®ÐhqÀínÈVW6¸¬ÝÆ[¼Þ𰤻 B/X, ù ±OäùQ@oW¶%âÔsùj$l'àa?·Y&|G,-õ{1tÕauÇ<ÍQT»ÓßSlMq{Ù̵`Áiw¶Ìçá.zÕ³goí_Q^ïâ×@»´8WLÕKºÞsInï-ÂõVìu2â ª mÛX ×:ÛÉÿ %Ìa.4\0GxÄ¡/æ'%L _ŵxjÏÉò¥Vó¬ ¸¨à¯aI1ýÄlvÎíªOÑ`Æo:Ë. Ê ÃXver¶Åñ17G :üâ°5~ -Æûs5£±¡8m=ëïCnºµ3ÄÖ®|Kn`BÑn8 2¢Ú/båHÑWyô={ARòjvÂF¨£GGYÞîßJ0 YV®îzvçÕ_C®ÓÃõ. ¡ ³°Ëåoç¼%àñÛ÷ T;Jk3HÅÏ ´|ÅNùc"{?D$]ȺVN°áiA} n{Wö[ëÞXK_¾ãgÐ;{¹+æ '¬ÒÞk2/\ 7->Ç1e®V÷Zéjê¯akãYîË>ah ôV /XÙY- W|<ôªÕTâá×¼=g>´±³u²ÔníçþÊ2£W{µj±fú~³0.\JT~ã××Æ%JÁº% ¯ ¢ðë¼qûld=1ªõéSÛð¾Ëvz}¦kG¨~¹a`áÈb°t WCj qçpC¡«ôçuûP=ÃY OÌAl±´(S^´ñ_:Ô°*¸"¢«Z kïU\óCuN °Æ 44ö<Ek¹] t[w >0SL{·ÐÆà¿!Ù|óFÁ×ÂZº½\öéë1HwÝ ÃÝ¿äçTýa©@ÖcR)®ÚßYkzªyû@+Ch 7îÎBJ¿yA_Ü®Æ8 cµwNfÕ¯¬¼¸D¥ès (C$߶Ù)GÒ³-(R9yélr¿ÌÇ1Í[ â2³A2Û´[n ½?pfà9u*xÖfJ7Ý*¿«WR^·õÍHUbúêh «7Û8×?@ªMd²ÊéÆQ6äý0vV&Q9þÔº¢ÆAÁëâ¹íSLÖk9+Æ\Ëm óÇ51dgn¥Ê.®ÔÔ# 쫯=4Ã/:õ~òý!l¦ï¦®2 Õï>¾Ó2ZÕ[;T¸3Ùº[ð6 #Ìáª4¯É¬Æo¦æ%KCP". dÑå¢X·â#f ¶ nìëÛo·Ð Ý7·-^"Ñ4ºQ¨©«FºJ î·ø ĹrÖÞ§Dðcn½£Z9éPXneErÕ·ún`ì?}CÂñEÈíãoH©[Xí-f ¼fhï85Õ!ñ¸¿A2ø]wú)iªï¨Ëoôf`®\þþ\ÂXÈRè%öçb>×55XçÏhêÊËizXeÐfPÒë;ú*4y,áÔÐ|Ó£Í{%gIìô..òùþáFKP-RðCæß¿Î"ÿ 8F3Qäém{N_§é\s«Èðß´C6 C] ÙüG>B Le¨EE¼¶é©Jÿ ³kóÚ`&wA!tÉ]AZ2ãzñ/ òrÔÜf¶9}IºVa>° QåýU²Çøë(5[huíÓñì.ñÛP4TèRòUl¨¢öÕñ\õí¢x ÙýD![r+ù :íz±R :Û¨!±¦=h¿K/éCc#7bGÊta¤îta8m,ÌÏX5IÆ2T P4bXËþ56LX±F¯`Ác¤"{ÿ ¨»Jê à¿O¶JNZÇîdZèô¥ói³Ù¹z¨·õ¹Êåÿ ãA A@b\¿ðÐÜnÝhloo¡ðbåúÇÿ ¹råÿ ;ÿ Õrÿ ð.\¹ü¿ÿÚ ïo¾úÛ{û?}÷Ã8 ,¡Clþë<{>÷û>ýì/GbJ1RÉ^[Þ¬ç.¢8zE¤¸U(~l3 ¹<yk¬6(þÖÀ°ÎªCõ þòPòE<ô¤nQøNí¦Í% ènjvµH ëÔA)Ïk¡D>r@3¼{üM o fßó ÆsÙþMTÛëì$F²6 1ÛÎ?ûÕæãþçø/¾ûï¼~'}÷ß}÷à@ÿÄ ' !1AQaqð¡Ñá ±ÁñÿÚ ?øD$cða Ò±?czV1èâA¢7¥bE ÐcDÜÀ(_ðC ÄÏ©}ý F ¢ öÚXj=&@VæѵÞXÿ m] b2Úº/Ö×ϵ[AX`¨Ä¶õ?b:ÂY¦vǶeçµGÞIÐ[ s+I¥hÖÌÀð Ð!9®'<ê°à`P@BJ\^ÂÍ =±{;ï^`²í¦÷$eS bÙzûRàÎkó¦`7*KïEÈ;C¬B{Ö'++PÐ6~ QG6¢,1Úä 6CH2ú ¦lÝ{ñ¥!U¾÷¢ ÚV¨"Ûq¤è|ubµþD&Ö§Ü ¨Ãw ¾ðj¼v~*q$.Äõ© × C²4ÉÓ¤QÄ Á{1.!-yú jû¸Ô*4'o?Ø%Ñö¾GxÄ@ñ ø¨1,ò;~¦@ §ÂÅ ó^Т%Õ·R?Nêþàh|óª¡ ®aÀw( àfHÒÙL¡ ¶é³Ä4"N»>qâÚÝ> Ö (^Û/Ôº k9%p ã \CL v¼1Z?M/vöµ íÐ º*ýÍ8²ãÐÔAÁ¡>b,«öîVv«D ¨´ÏEDn#¹?¨/>w3.Ã+ÿ CåTo ¯Ø+¤ ° ]{} 'Ô At æ äßÜ õ BÕÅèhzãXZ µEzBÔówÄÌy ål Æ`ÀTøþðñýÎñI =ĮɩqJuƺ^~icµ"2ùLkp+UÝÞyH64+ÇøÇ(é Æ Ã±Û¥Jæ:8Ô èºvÜkK×ø`¡h4ä}[CY µ åFô¤0aÞ[y¶£d&¥sFë°Ei ³Úâ³®6:ppÎ i +ÁðG ³m sDâÿ 1Xó )ðùq ¶ÂÖö?¶J³¯ AZ¦ü¿µw¼=oæ"+DY¢ÎAk÷AKbt¥_FµW¨CþÙVúAÁÀ`E!Áõ7 E»] Ñ(ÑRú-°Å ÚýéW b@T<ê=º½Ñ8@1J$bëï3ï5îå BE»¤¡äÓû T$l _]?p`L£ l(¨¡%®úºB0ÛP²wdì©0 BÞTòòÔõQ£úR!/¬$ D? q"~`8zÿÄ ( !1AðQaq±ÁÑ ¡áñ0ÿÚ ?T!>BT!>B!B Ý %D¸4Ø¡Aâ%^Ïô;ѪÆJ$´~¯êÓ!:1ø iàFÆ2Q§hºä¹lZh µ Ú§F)i§éðko9ÍÉßþñÜxe©[3zøN²'rQÜc¦QàÙÔØn+ÔÔ1 -LcÏAªwI½1s®E<H4&×nÿ ßATdù%îm¼SÑb¶ÝO.ò c·^£bÄıä2;«:gÙþ qäI¾÷ÜDÑYün9Íç¨ûÖíç7Mø¼÷)h;î%¡/Æ·®üÿ u9¾âzó Pv(Ýkø ®Üè5jË~Onù!og»ÇãöÄ:+G¸¥±ÙÑz^`¥EÌú0%* êo¯oèÕ;sðùAÎ{ a Dú¢ ¬ì¼èH» 4¨éy%F¦0¢ yÎu!ZÝÈèÁ.xl2Ezû íS{íð%5öϯìj´Ï\Ü'¥ª?<þóöCI8ääý Bè¨ N¢\g<ËØX³¥( ¹ìnõ)EMZ0бÑJKA4âO÷óÏдRÀׯÑJRøÒ¥)JR¿[)á|ÿÄ ( !1AQaq0 ¡ð±ÁáñÑÿÚ ?þ4b²,Éù&LÉ ûedr>¿dÉü0ÈdÉþXzü+?dþ9&Gü#É#þ#ðû~õõã!ëð¬æö϶FC'ÆOGáXþRà°ÉäÅ;ÈúÄøÉÿ \ô Ñ .Ö`UÐÙÃ?lV'¿Â漀 zE48wÁ¼ÁàMüÎï 2Ê`¢éK§¿ý¦}q(«|ů²°F%Eêt|ëNǪ Nh °Þ³HH¤ ]·M·4ÝO¼s B*Í<~CqL;Éc³@TXksXÉ&+ñ ¬»3?¥¹ÿ ?& -ÃlÐÝX5¹T6(0Ý\ÀfÚKìï½:xÖ¨}\@..¦ÏüLQ6 ǾOXÆ1óGc÷èãí9haâwUv¯7vÐ@¢¨w¡QDßMþ¬ U²èÐÓ^ã ÒÒP(ª¤&â-lK¾ù÷9X²#³÷#ÀʬÈU/úô¾Ë z¶;Ý¡*Q< Ô v0£c ²ÏLÙ1B#P ¼øâ5" ÊÍ ]ò«{ç2ýÆýF{¦;éM08û¾¿Þ8YDp¡ÐaêÛÃϼp4*,TÙµ7×·=ç* Á!k'1¶Ð6Ø êÐRh0ªIAAaw vyZô_ÛâÁÀ¥ôEÉJ1 n & ©Yj°Ò~ º<îqÀFÆB4Mâ²"gÓ¶ð[n.¬å òwí'yUh¢ò.SÌ°µºï>{(ìë3{@J íNMHª¢A|)r:vqé£Ïu `J¦<AÙ¢ÓZöaY°BQ1E/ïÑZÛÙ¦ÙOî dÍÙZ¢ Ý«È%UÍ¡Ý/ÿ ¬ òéð©_¼âéÕ%@T"ZMôôE_y<¦ÁGl¥~Ë,Æ x MIÌ¿NÀÐhóå/XIR=´xîh*L1ÅÐÝÀKCXD¾fåÂV.\ jÒ¦ç·?¼g+é Fî#kT4¾èô_,\4úi þ×Uá½è§]¡Póç»ë2$¡ DÓ~íµg+È*:UavÖ:Q¤vRí¼ò\·M2-¦êPB¨£A 16õδ+SE¾õ«äÁ¬TØÑwSZ®ùÜ08%OU ®©òå nÖÆûáÁ¯ïM :,Ö¨*Î.Iúÿ ®X1{ åãi @ª°ùo΢XîªãV»2fÕ°X¹ß3vTñ@miºXzW¸3kP( ýz%G ¨¬ÒÓÌ>¬|1Üà¾MBHUk{ÂÙØé U~÷¿ï/Ô$¤iÏûÆ?óLÐD/°kŦØ@Þ}æc.lÆdcZ%{Lðé·ñ?é¶" ] Uv¢Ãæ ô8o¢õ·:»ÀÍ5oêú3n æñ¢ÞD:ßúõLtàÕQ¢M×ozÄ 6¢Nº:Ðr1 x¬¦²i04Щ7ÁóÐiðݺ:swÄÛxT¾bô0 XâhkÞu1sðt#³$-`Jm³Â<HLYz`")b1?`üfÞb}WUÔ<{yUz®^Å (K· Ï<×q5H+ лaw¡uß;= }×ç"tD,Ø ¢t~f'<?1òLLHCÆrSf®å&è Ðv{Â\`"JÙ·Í'¿/Ä Î Û j»~ÿ \5 %#É¿Þ.Dìq j¯ö;òÅK4Wðw9ÎÌ8w'¼9ÒÀíF¨Ö$ãc§JIRC9Ê|#çt #.¦ÿ {±49 iÎþµy ÇnAú¿ýÅ7ø ÓK!, JH·ØH¡Bí M /ÛÜê-æ Ý ¥[n f ¨ ÑtÓºL=:¶|=ýåEóA+ôR¿& Y[³þ} OÀ3\'m£E64çÉ³Ï fëfR ©ûC¿'ªuB1 Ð"¾Ç3 Á6`§2Êb°]lÆ&(Ò M/óÎç d^° ªº=ªü· Ý/ÿ 1b ©¤d÷ëçëð\v âM¬©l¢ I´M>ÑðÙÜ¡6 ÇÓý$b@ééj¶öU§\ää|iÑ¡|ôMB>B 'BW¼Cj¶m@ AVÈ¢ºÑÀgѵscÕei Ö^o ät.¸ W{q:&%ò)O$:ïÓÉZd´'M@Í÷J¢9Þsë*S9%þR³¸çø0Z ¾[|Ë»e²ìWt'cIm<"át½Bªµ¤Å³KYcÐö:ÒÁZ¬$q[ÅÖÑA!ãÆÒ X]ì Õ~ÅÕ ð¼ÓÖ«©&p¢ÄkCµZð e²HvݱE$Äø+î|@ðÿ ÀNÛ@ðÆ>cëlG- ÛÉ,£Å4Rï4¤ÝUCoßhñS zÑ4rtâ \9X}k·øUÔº ¯gX»0hõÿ î@òëór@«àw× H4TTè¢MIµÆÃÅvB&èÀYs@t×È@ýÃËÞR<iŠШTÑ]|¸~%-b@ehKk±4. 5 j»µÕ^YJ @7Ñ¿Êg/?daèîæðDÜè+»[5JÐhPiM?Í$4%¡ ±éIÃp,°¡ÁWöûÍá ¯þq sËmb MÎ-6à¾J%¨®Æ«±íÕ4 oÀEKQ h*PèÚ/B°éÔi¶= CCO ´¤_x« /4 SÃ&Ì¡Ó&,ñÛâÜ¢ÀeìÜ ÂúÅRõ¸¸þó´ NTuD¼ëÎû µFÊ7«A´ÚÇTãÃ&®&+ PjwÆå`<¡ÐnÕ(DË h²t¶® hº%)(ïÂ`Bf£~uÝeþÿ ÁU«q1ñs£wµÍ)-Ã]Ä i¡[4ǾM&ì ã Ü jnÈoÓ°¥ ñ0á±Dìm¬VñD+`Æl)EJh\ èrTKg³]óøÍ1ÚSà§öau i { m1 ¾b¡¹vzÝ\0 °ÓfÕ W©/ %ài@:ÏGXT *]¨u0JtÅù Að Ô Ô@CÜù!U>Õç HøüG %³kö¡öã°Õ JCÛú ©hQÄw â½d@MÕßA 6kÉ° ±(@^£´¿Ùíï=ê`2 X`õ²nWe<Ö¢ªhtìIðJùì9¡B¿ûx Ã[Á#²Ú .&9¶¢Jª ¦[ BU'Ö° θD@TÚ}ª ¼^(YeÈè+}¡¬Lêá! °åLqm°ì§V¢](l | jý-$¸b£Âû }âêK&XM]ø:Æl #xÛµÔãtu$T°´ »!ñ 5 ÂÚÐצºà7´ÖÒ.ÕoÊ¿8Bh¨öÀ?Fx1vÐíø:ãh$JD¡mÖ;~µPkI gµµ<´ ÞE.ç ;g© Шvi õÝÝCMÒ¥¿éÆý#í.° ßäCô/éÉeÖPEØAÐÂ9¨nA)TUúpH´j_6B³H P@@Z@< ÓVV¯íÛ¤ ªø2ÅFı,8`UÏ D ð /q àöÙ¸Z VÄw]· Dè>G×ÖE%Í à |ã j*Â&ÕÐãT °Ó×`ýó¾gj»ä®°[M=êÍÌ ñH<ûÂØb5g@ èM«4S`ªðÁ³è¥PZZÖ¦R¨F]Ç{Ð}G7Q)Bíß ÒoSab~ùé¬8ù$Oû¯÷ÑVÕóùEø¯¼E<"¥MBºÍ$Rªô/`¨^ Ö5ð¨ÓPZñ¸÷bºä©Oø pâ _lôaGô@È¡ÙàZ5Á@$Zе¾oª¡ªí×>»GÅÄÊbcÂR)Vü¬Êä{ óB»R D@ª(64E O³¸`4:I@Jè*å;U"@+7Í 08Noh 6¶M÷úG Fè¬DDI}Be4!¬UÁ¸qdFz*÷JÔZò®v:ëÑp@QÁûtëNè *½° ôL7m[ÍØ=Q®;ÚóXR×1Hko]o¬+RS<9ø"äÐÚM @µ©MV¦¦Æø Ȫ1G}!ãÀnmŨ*¥O±õ 4Â+`ìß ¡È ùY$E-QJsN ®5µÃWË©ô~ Î ³YµÚiòöë8$µáàXY^å¦D"U Q³ÅÍ@úMÉÈÞ´ ÖGèõj¡Fê÷í éÀ! P²þ¶ýõ-üÆtd v<×#GXé !ÐG´v\>X T!Wua lêÈnvtÀÙ?ßØãÓLM>Çö`B:=%±<©;¬pÎÔh¿m¨¿T ñ ¾8¢SE³ Ñÿ çXo"¶§ @ -¥ÓÚ ?Bªpu ¾íiÍÙ1 ÃôGk,5 @ Hé0õ´xÅf é9ÿ {Éh¨ÉDÏ>(î&n t~A{÷¬×Çàeè0¥¬Êl¸ T1 ¦êNvîÞMjyl+¼Ù#ºÌ`±P@úÍ åÚÂx î·¯O§è_ X¥gZ®º»û¦1 Ü6ÍîªÁ`ÆÄÖç; \Tܸ pV Ù\# WÁö¨!IáÒ<Ei̱Á<Ss§ßÇ£Á{Ê+kÄ4vÖ;(êØiUgmêTUÙÍMox qÏ+³^VF÷y @ § á,»H;éaßÛW.I3a$¿AwKXOÅ íFìØ _÷Ð|XQ^³mRÀ@PRrg#ÐcànÁãÂjÔ-odP ÑàéZEAH_éý,Ð é6Ci^G,ªÆRCr¼tkTqËó2ÊÓå ú X¢å t)¤)Ùc¤uÜòµU÷«Ì £PºÑlçbë,± ¡c Ýð{À |Ò yÀZ%ÜS"A*{×lØ@ÛáÞ;õàw´W»Êþ. Q(DÄ;¶×¹ºa9ZðB¦Â#£V HÂ`øSÈìX¡Jp««Zp'¾º0=â m¢î íÕ-I Ü×9ïíÏ 7 ëç \¸8$è% öï^z ÜïS&Ë¥znA» 7:G³ YÈÐ ºV»Tú ÔJ-Z8YúÝkÊ-<´4xçëÏr£Õ7 JóÂo ²`j0*¿[õ|ñÿ ó U¯Î#ÞSÞ ÂbXF:Ü]9ECuõuÜÕ=ñfÇÆϺ c¡%ã[ÆÙK©¨0ôA$Ñ'ë 3p Tíò.·IÊbnñÓã$!Õ½CK¨Ôde`ÚzÌBi4Fíßµæ\®\®8ë 5íYú |®ð h¯´NõøÉ";; tmxjùøæ @lGM¾1âûÈϧà&!*8¬O´Q×E 8SíNÑ}[/5xɪó×&85)HÇOiòo4b$nÎëYµC4Wéòw~ DW¸áWò3Ö:E10Uã§|Gab Py´aÞöc Ô? 5<QMÓ ;SOïí< ò±×oUì÷OfÊd [½0ç1ª´ú1Õ]þ)Ê{Êåq~r?ÈS °£ Q )8`$øÖ7ûË/æ¸8å<<pÜ¥8u0RînÎI Ýæ¢á@<âî AOXUËþJeÊåråråË+ü)÷ø®\\§¿ÁX·üéË+üª~üëï+ïü®S.Wùiï#>YY_Íråÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14228 |
| Response Body - size: 14,228 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ùóN÷¨Ãp` h5MM À ÀO ðÐ0Ð3á `C ÌÐy&£ ¦è(À(À(À) ðÔÒy0Ðxn¸áJ<üÅQ\ MM `jxnµÚXà½(*+b:ÇB°Ý Ýê~|«<N5s:§È:ÇUr é+òó´°âóÕ?iÎk½ ëÓ²cÛLñN8FÚÖsã\®=b³7ÉJú »¥ÕÊòÏçéÞ âì9 ÐqXu!ID[czιer6´qc=È´:7¿#Ùѹ*%Asíà§6b*çW8u½¼© 1:çºr7CICZUÒwN½eo"Ì·.Y`ÉÛ ù%×Ëï;ZÐÕÊÕ¬ªg ó³hë49¯×ºi_G¯£ëJÍ¥Q«MzÇ.ÎH÷¤©]üÍÔ1)*ÙAÓO¾7µâäç|§Ô|Õó6{Ü<ÝÍñÅÚ=)*Y¯:Yɪ¶Çò¾GWçö~+G¿YÒ5zæyÐ^T·×F ¼_ÂÉÍù¿øµçêôùkÏRRtÏèÝæò®øg&ÔÙµ@çå%°Ëfûϼ¥zm~G]nJ¾aC+ñ4¥Øm«éôìJÅåôf*¶ (ç DW¡ÜWwIͽòÊÈ%a1×LI«vwX]ÊÎC£ xj$ç¶å«L±ubÍÒÅo:ºcÊF¥¼¤&Bz (ßNf{yM*éë+ήYÍaE}²}ÃÃÐ ºµ_3úë$hlR;é~^bçÖttstvKÉñjª*Ãsjj¿¯Ë<RxtCcQ:gç|ò¯ ¤¯%p@ÈutÀ5\lüijUSÕEÅ6Ì`²=;ÌK ¶JJç8Xê¤té¦ÂèS£åë,M³}iÍÚO2 0z``=ÌLÓé´À4À7 Ea@a@qFM³î ÜP ð Ì ) ÿ ÿÄ * ! "120#@BA`pÿÚ ÿ Í+ù8<BþJuZü¿V T¯0µ+d-ÈX`) ^uBã\Q) nµà ÙÉj¨WP#xã©¥Åö ãì °<{e#¾æFc;Èç[v+ÝÂhqo ª«e ÓS.CÔ>±þþèáj'U:N®Ç?SábÑ"Gdö²HɲäÎF")¨¿L½í¨Hâ,ë½Àn}ß}¶ ËO¯=¾ãP¸ýËUê]¯ÀDvà @¥N#âGî` °Ù®5¦7榢®Ú²äemÂWµÚÑäÆûWEW°ÀñÉê ÿ .q¬®ü!*¤JÐ%Xú·´ã¢ ¬S¤ öQì8¼+ ¶â5*(Ý´`Ü®è9 îÂPJº"@Àv»/)Öõ N£.Cøî«æ¶ nû.TAò_Èul2cêr£`Ëóbcìa=Áqp]u¹þ ©Ê_¢ê~tb# ÞÙj!b¿ÀÙ:vVFüN#1öjºî ûúÊ~CEÍedC ¥ªWE7=Î?Ëb.[ãTàé¾Eäj0¯ _U¸ ÜáÊ9( ëu°ÛV!Dn\U cÑÖõä¢=hû j] mòE¦cz¢Àp¡@ E{,Æÿ "ÜK¾Eå`Î_Ô$v¸[|µrü]®êþ5ÈáC4&z[µÎfï¸Ö\±ØÜ'# =ÄQ v±ÀlØDÔøÚ¸þåéÎÉäÐʺ'°ûâ ÷ ©R£¥{K2AìµêGp U/²þ· svâüQÇÝHnËí2®QÖ0̸çÈÃbøïúN« K?Ø_P!ñ¸}Â{8fÆÅaxíá÷ NW ´ 1Û5ø¤_î%LmÆrÓj îvZ¼WéÇdútÎPd3W@yÜcÉ/W9 0f.à 9K^Dù?r=§û¡41G±c\¿ÅûÐþ g)v j\¿ûßÿÄ / !1"A Qa#Bqð02¡ÿÚ ?¿u«WíµjÕ«÷Zµ~ËVZµjÕ«VZ´\Áºl¡ÂÂZ´\ÖßÙC_ÊõQVíZµ6@ Ç<´7ÏótÜ°åê¨Ó ûQd Jy ÷ÚÈ}ð¢Ê2>5ïb*ÇËÖ7Z\Ó¥ÌhÎõ3Úý~·B|®¤±¹£ý¨r(°@M1{¼)È#Kê!7Wu64¼øþ}V©"qul¥ÆÑÝ#Xß×Ô¤¦Ì ¹äð£ÆgW°~èÀÐ8Y )ËOMü©5´®°s÷;'æýEG5I<©atG\i³ º5(§Ú.L À3´ìÐQËû§Üëg*Ièß]mj Èe³ÂüE¤B9Ñ *W2A²cÁ^´ZĸìW®Ðâý'æ´rÊcü©¶îb$r£ÊÝbËmíÙGñæHç ©Ï*~ ·Pkáe61 ßá`]nf¡ªfÄçè¡d] ¾ wÙcùåH<©ºcûJÙÒî[XÖ#u©DÖiíR Áºö´) ³J,KÝC,ÒÔÜ4näì6ù*H£lÑ59zMÖ xMÄ{çVÿ /(á°sº t°n¥É Tx= x³äìiO/SeYÒÎTXÚSX Ä&C[y 9Ø%¦#(!OÖþê8L§¨õ3;Ú@kÒ|ªÐ/õ Í´÷ ¦È.:#å3 @û¨¢ê¨¢í×ôåFD/Óà«T8Í-*`è$j*);£}¹ n»V> hYQ<&ÉîYÒle æî¿2Rßú Æ6j²W4©GK½ »§çt|© 4Î1ªTm;¥6&ÄÂ¥H²Ô!×÷Qc@ð¤iA©R©¿ÑºO®ÝÂôÎsµ<¦ÄDz*Uó¥J*T©iT©R¯xT«úóÿÄ $ !1A QPa"ÿÚ ?ýUWùQ³ÁEp²3í} è¢c-*Þ(¡éþÉÉÚÑ|] ú2(¡ª:èlLNÊ1 N:2Ó$ElzÑÇ´bCb%C0© «,?Éé\ýÒFÄ*òO SÌxli ©ÉBÑé%/p´;±phÆôB mfBt&w¶{JÆü$YÙÇì#Oe£%ÅdV»,LËCØÐeC߲űi³h²ÈðSmbÇÞ¸²Ç´-öEJÚ} oáfEÍÊQ þ§ÿÄ 6 !1A "Qaq02¡B±ÁÑáðb#@R`pñÿÚ ?ÿ ؤþ^÷+ }Ô½üÕá²²LàªÜg#1îLp÷¢¨ Ý.Ôd À*÷¦J³kâ$ ¤G ªö|µW8CÙÄi 'Ôê¡¡P0¾ájcD6nwS¬ñÍÕ(tÝi¼f8±åImà¡Òµ`i!®PuäéP¨;²Çf6dµß¿öT-øG©íò ÝDdÆU¶%Ð:X o~Ïõâk¬Ð¸«" h[}¥ F §1'ÐÉ.YÑYu}wqk}× úöF⨡ 7¿ºbQ÷Äc~CC{aNò¯×wF;©Eĺ0«6 ¦ñ27exV~ÑÍ »£0 ê'wV$ ºa ÁЩ@hUºµ*+$£S<ÀE.®N/;³òÞ8u¹S"¹ÝYÜKt$,FêXæ ºÌèOci¢ú}lh¼¯^ë¿9Í"QÑN0L ÕªµÙe_$ ¨'^ è6ã=&Áì @wâòÅ«¿.ß}>K+¦f>,xdOä²¾|ÕºLöÊ;7üQmÇmM§ÓõNë#EÂÖôB1Ù|.twD\M!=¢í'IRèÕ_<-¶öeî=ÝD;ººX(ÈÕï¶p« ¨jwN«£¦4Óè2Fª6} aaoÌ"\óüE»gïâFe&'Ç)о"ÏÏi³sL0~H3dû ê§Ã¬yAÂ">ë_E$åïr´AN¡þ+ýÆbê .$ßáqÊl¦æ\ªôVPêE Dá §ê¤m ´ád@ Åí84?%®´£ °È=T}UméiÛB ZëÙ\,Sv]q~ª Y^` ×HMcõ\@½ÜÕ ú®<X(¹ÏëáÃ'ÍJ¾YÁÒ4ZÉ6F+Oo Ey)Ìiù \O¦[¥ÿ ú;U®V~¡tºá\$v_¢z z@4Ï_²0>9³»²ü$ùV@]B) ~ÈÍÍ '¿T¤áqXnÃg§M 0z³góC¦5R pÂ5ß>P1 Ý5ïÉ0=ïªiu VÞÙË÷ª¹¿Ë²Ð ʳ~¨Hú# 4Ö0@ ýZÈ! ªÅÖJ.3Õ PV« < ÝZÒ̯åz##*¸FëÂ*ÓÌód æ wdÎT,Ȫ_åÍ"ûÅ£éÞ#¾àayWÈfȸ]C;ó?¢µ#Uä'5ÂCIð´ÞâFï²t]¼ªådÙê«|» [¸x´Ç³hÝÀfàyC"+%qí ÂÙBh(1w* v9ü·¸ÉÐwO`lEü¿°«â@pî¸rP{H{¿Âhu,ÇHÝEJÙµñ/1Ûûü©dp_² åµä®W_4@ÿ o:¡ÕõNvª2±Ë êFW+fó<Lù©Ä(n9p*÷8[?i'ÌJ/¢qÚ7h')£Ã«ðêµ×ÜdOw}á:Èâ ÓjU¢oÓÜD8²x9n«ÑACöWÿ Ô ÷ ÉP1ÿ ÿÄ * !1AQaqð¡±Ñ Á0áñP@ÿÚ ?!ÿ Jÿ Ë©R¿ójWþ]J*Wñ©_Æ¥Jü*T¯ðT¨°ÈÊÿ \âë½3[u¨À<2¥JúWòÑÍQþ2Iïqt¥\©n¾*T¨Ò-æ2Ýn@E !Ü}~ÐpèÅU¯:(±Í1¤¯âiwÝâ·UèmjúØ4ÿ UãåUhôÈàhN¬`û ¤b¥ ¨Æk ýDÝÙk× >©z#eÖ ¶Ñ®Lÿ ¦8£JéÇ_^Î â8{{þ¥$ª³¦"¨ÒrT¯àdËA{Ä´ãí0§ R© l¾3K¸]yMú|¹ÚMÏÞU í¥°7\iÒ¡¯Ü©R¾·è½Ä -:~}⣰ÂXò«Q18NõæjV½²] !ÇÎÜjdPÞu]\Ï8öAtk[+Ì¡©R¡LÐqurÃÉÓè .ªþu%9ÃZØY¬g1YÔ«þ]~Ù¹mîÿ ¯l0 ðatýµÐmªéį LµÄb¦l\Q= -Ûbç xÜ XÇlÅÄ- ~zÎÓ_Äy*üEÐ]ï¢}@ØÕ.ëþÿ ©) k¸?E#élü;DÎñ~¼¼Ü`9§ þ¥Ø!ÕûÚN½5¾h i²µí<'T@óÓ S úå(¤g´s§Ü®Û=Ò!gN¥<ú½±ÁYqÅCkAà'^%@5t^¿oêdÊó%è¬ ØJí Pê×Ypa [[ÃQ+T¹ÅâÏù ÜßIP#Kv¼wñÇ=åLcCUÞPâþçá"ö+¨,¸1CL¼øv1ÚTåߧ¼`f`P·dNeÑ*6g¿F/0É®eµuséùûtERÐ6;õûcÚ òTXÈù°)ÖfëÒ¥âë ¶+äý}D!Õ*& ⣦X<>lí¹Bp¥6Ðï¯6ú%P)mà7ÕÜ4'\tF£´²¬Ë¥;Kà1õàB F[ Óì¦Y%!Y~ó7_luíä`Ug'>Ó^WgîþÑ¢ÿ æ(gÐ!±N· zíÏbvýLJ@Í_}@ÙTlEìTjdn J5=u/4x(C}>°T«ikeà}}%tâ]{MK{J() bI6 k¿Æ"gÐóý0§4éÀuþã|-*¯Üºùä,Ö£5«iJ#7Wn}æZô4ÊåR¬¹ºûMF¥ik²Îæ2u2f £\í¨ÄÎ5gnÿ Ü AêJ¶K`v׸ÁKµ¾9ô;þG B©Tx h'Ëé ¨ÓZÌ ©ÂáÅu õéħ»©W^OF¢ áÓ JÆ0e ¦^MGªëÞYß\T~o.E¹ ¯(¬ ?®?¹vÔ8»^·/4_-ã}³~зºÊMôcêóþÍB¦Îò)Ì©ãb´*è }içæ%ìi ª9âPb.]g½å °2'V¶(þ¢[®ÐhqÀínÈVW6¸¬ÝÆ[¼Þ𰤻 B/X, ù ±OäùQ@oW¶%âÔsùj$l'àa?·Y&|G,-õ{1tÕauÇ<ÍQT»ÓßSlMq{Ù̵`Áiw¶Ìçá.zÕ³goí_Q^ïâ×@»´8WLÕKºÞsInï-ÂõVìu2â ª mÛX ×:ÛÉÿ %Ìa.4\0GxÄ¡/æ'%L _ŵxjÏÉò¥Vó¬ ¸¨à¯aI1ýÄlvÎíªOÑ`Æo:Ë. Ê ÃXver¶Åñ17G :üâ°5~ -Æûs5£±¡8m=ëïCnºµ3ÄÖ®|Kn`BÑn8 2¢Ú/båHÑWyô={ARòjvÂF¨£GGYÞîßJ0 YV®îzvçÕ_C®ÓÃõ. ¡ ³°Ëåoç¼%àñÛ÷ T;Jk3HÅÏ ´|ÅNùc"{?D$]ȺVN°áiA} n{Wö[ëÞXK_¾ãgÐ;{¹+æ '¬ÒÞk2/\ 7->Ç1e®V÷Zéjê¯akãYîË>ah ôV /XÙY- W|<ôªÕTâá×¼=g>´±³u²ÔníçþÊ2£W{µj±fú~³0.\JT~ã××Æ%JÁº% ¯ ¢ðë¼qûld=1ªõéSÛð¾Ëvz}¦kG¨~¹a`áÈb°t WCj qçpC¡«ôçuûP=ÃY OÌAl±´(S^´ñ_:Ô°*¸"¢«Z kïU\óCuN °Æ 44ö<Ek¹] t[w >0SL{·ÐÆà¿!Ù|óFÁ×ÂZº½\öéë1HwÝ ÃÝ¿äçTýa©@ÖcR)®ÚßYkzªyû@+Ch 7îÎBJ¿yA_Ü®Æ8 cµwNfÕ¯¬¼¸D¥ès (C$߶Ù)GÒ³-(R9yélr¿ÌÇ1Í[ â2³A2Û´[n ½?pfà9u*xÖfJ7Ý*¿«WR^·õÍHUbúêh «7Û8×?@ªMd²ÊéÆQ6äý0vV&Q9þÔº¢ÆAÁëâ¹íSLÖk9+Æ\Ëm óÇ51dgn¥Ê.®ÔÔ# 쫯=4Ã/:õ~òý!l¦ï¦®2 Õï>¾Ó2ZÕ[;T¸3Ùº[ð6 #Ìáª4¯É¬Æo¦æ%KCP". dÑå¢X·â#f ¶ nìëÛo·Ð Ý7·-^"Ñ4ºQ¨©«FºJ î·ø ĹrÖÞ§Dðcn½£Z9éPXneErÕ·ún`ì?}CÂñEÈíãoH©[Xí-f ¼fhï85Õ!ñ¸¿A2ø]wú)iªï¨Ëoôf`®\þþ\ÂXÈRè%öçb>×55XçÏhêÊËizXeÐfPÒë;ú*4y,áÔÐ|Ó£Í{%gIìô..òùþáFKP-RðCæß¿Î"ÿ 8F3Qäém{N_§é\s«Èðß´C6 C] ÙüG>B Le¨EE¼¶é©Jÿ ³kóÚ`&wA!tÉ]AZ2ãzñ/ òrÔÜf¶9}IºVa>° QåýU²Çøë(5[huíÓñì.ñÛP4TèRòUl¨¢öÕñ\õí¢x ÙýD![r+ù :íz±R :Û¨!±¦=h¿K/éCc#7bGÊta¤îta8m,ÌÏX5IÆ2T P4bXËþ56LX±F¯`Ác¤"{ÿ ¨»Jê à¿O¶JNZÇîdZèô¥ói³Ù¹z¨·õ¹Êåÿ ãA A@b\¿ðÐÜnÝhloo¡ðbåúÇÿ ¹råÿ ;ÿ Õrÿ ð.\¹ü¿ÿÚ ïo¾úÛ{û?}÷Ã8 ,¡Clþë<{>÷û>ýì/GbJ1RÉ^[Þ¬ç.¢8zE¤¸U(~l3 ¹<yk¬6(þÖÀ°ÎªCõ þòPòE<ô¤nQøNí¦Í% ènjvµH ëÔA)Ïk¡D>r@3¼{üM o fßó ÆsÙþMTÛëì$F²6 1ÛÎ?ûÕæãþçø/¾ûï¼~'}÷ß}÷à@ÿÄ ' !1AQaqð¡Ñá ±ÁñÿÚ ?øD$cða Ò±?czV1èâA¢7¥bE ÐcDÜÀ(_ðC ÄÏ©}ý F ¢ öÚXj=&@VæѵÞXÿ m] b2Úº/Ö×ϵ[AX`¨Ä¶õ?b:ÂY¦vǶeçµGÞIÐ[ s+I¥hÖÌÀð Ð!9®'<ê°à`P@BJ\^ÂÍ =±{;ï^`²í¦÷$eS bÙzûRàÎkó¦`7*KïEÈ;C¬B{Ö'++PÐ6~ QG6¢,1Úä 6CH2ú ¦lÝ{ñ¥!U¾÷¢ ÚV¨"Ûq¤è|ubµþD&Ö§Ü ¨Ãw ¾ðj¼v~*q$.Äõ© × C²4ÉÓ¤QÄ Á{1.!-yú jû¸Ô*4'o?Ø%Ñö¾GxÄ@ñ ø¨1,ò;~¦@ §ÂÅ ó^Т%Õ·R?Nêþàh|óª¡ ®aÀw( àfHÒÙL¡ ¶é³Ä4"N»>qâÚÝ> Ö (^Û/Ôº k9%p ã \CL v¼1Z?M/vöµ íÐ º*ýÍ8²ãÐÔAÁ¡>b,«öîVv«D ¨´ÏEDn#¹?¨/>w3.Ã+ÿ CåTo ¯Ø+¤ ° ]{} 'Ô At æ äßÜ õ BÕÅèhzãXZ µEzBÔówÄÌy ål Æ`ÀTøþðñýÎñI =ĮɩqJuƺ^~icµ"2ùLkp+UÝÞyH64+ÇøÇ(é Æ Ã±Û¥Jæ:8Ô èºvÜkK×ø`¡h4ä}[CY µ åFô¤0aÞ[y¶£d&¥sFë°Ei ³Úâ³®6:ppÎ i +ÁðG ³m sDâÿ 1Xó )ðùq ¶ÂÖö?¶J³¯ AZ¦ü¿µw¼=oæ"+DY¢ÎAk÷AKbt¥_FµW¨CþÙVúAÁÀ`E!Áõ7 E»] Ñ(ÑRú-°Å ÚýéW b@T<ê=º½Ñ8@1J$bëï3ï5îå BE»¤¡äÓû T$l _]?p`L£ l(¨¡%®úºB0ÛP²wdì©0 BÞTòòÔõQ£úR!/¬$ D? q"~`8zÿÄ ( !1AðQaq±ÁÑ ¡áñ0ÿÚ ?T!>BT!>B!B Ý %D¸4Ø¡Aâ%^Ïô;ѪÆJ$´~¯êÓ!:1ø iàFÆ2Q§hºä¹lZh µ Ú§F)i§éðko9ÍÉßþñÜxe©[3zøN²'rQÜc¦QàÙÔØn+ÔÔ1 -LcÏAªwI½1s®E<H4&×nÿ ßATdù%îm¼SÑb¶ÝO.ò c·^£bÄıä2;«:gÙþ qäI¾÷ÜDÑYün9Íç¨ûÖíç7Mø¼÷)h;î%¡/Æ·®üÿ u9¾âzó Pv(Ýkø ®Üè5jË~Onù!og»ÇãöÄ:+G¸¥±ÙÑz^`¥EÌú0%* êo¯oèÕ;sðùAÎ{ a Dú¢ ¬ì¼èH» 4¨éy%F¦0¢ yÎu!ZÝÈèÁ.xl2Ezû íS{íð%5öϯìj´Ï\Ü'¥ª?<þóöCI8ääý Bè¨ N¢\g<ËØX³¥( ¹ìnõ)EMZ0бÑJKA4âO÷óÏдRÀׯÑJRøÒ¥)JR¿[)á|ÿÄ ( !1AQaq0 ¡ð±ÁáñÑÿÚ ?þ4b²,Éù&LÉ ûedr>¿dÉü0ÈdÉþXzü+?dþ9&Gü#É#þ#ðû~õõã!ëð¬æö϶FC'ÆOGáXþRà°ÉäÅ;ÈúÄøÉÿ \ô Ñ .Ö`UÐÙÃ?lV'¿Â漀 zE48wÁ¼ÁàMüÎï 2Ê`¢éK§¿ý¦}q(«|ů²°F%Eêt|ëNǪ Nh °Þ³HH¤ ]·M·4ÝO¼s B*Í<~CqL;Éc³@TXksXÉ&+ñ ¬»3?¥¹ÿ ?& -ÃlÐÝX5¹T6(0Ý\ÀfÚKìï½:xÖ¨}\@..¦ÏüLQ6 ǾOXÆ1óGc÷èãí9haâwUv¯7vÐ@¢¨w¡QDßMþ¬ U²èÐÓ^ã ÒÒP(ª¤&â-lK¾ù÷9X²#³÷#ÀʬÈU/úô¾Ë z¶;Ý¡*Q< Ô v0£c ²ÏLÙ1B#P ¼øâ5" ÊÍ ]ò«{ç2ýÆýF{¦;éM08û¾¿Þ8YDp¡ÐaêÛÃϼp4*,TÙµ7×·=ç* Á!k'1¶Ð6Ø êÐRh0ªIAAaw vyZô_ÛâÁÀ¥ôEÉJ1 n & ©Yj°Ò~ º<îqÀFÆB4Mâ²"gÓ¶ð[n.¬å òwí'yUh¢ò.SÌ°µºï>{(ìë3{@J íNMHª¢A|)r:vqé£Ïu `J¦<AÙ¢ÓZöaY°BQ1E/ïÑZÛÙ¦ÙOî dÍÙZ¢ Ý«È%UÍ¡Ý/ÿ ¬ òéð©_¼âéÕ%@T"ZMôôE_y<¦ÁGl¥~Ë,Æ x MIÌ¿NÀÐhóå/XIR=´xîh*L1ÅÐÝÀKCXD¾fåÂV.\ jÒ¦ç·?¼g+é Fî#kT4¾èô_,\4úi þ×Uá½è§]¡Póç»ë2$¡ DÓ~íµg+È*:UavÖ:Q¤vRí¼ò\·M2-¦êPB¨£A 16õδ+SE¾õ«äÁ¬TØÑwSZ®ùÜ08%OU ®©òå nÖÆûáÁ¯ïM :,Ö¨*Î.Iúÿ ®X1{ åãi @ª°ùo΢XîªãV»2fÕ°X¹ß3vTñ@miºXzW¸3kP( ýz%G ¨¬ÒÓÌ>¬|1Üà¾MBHUk{ÂÙØé U~÷¿ï/Ô$¤iÏûÆ?óLÐD/°kŦØ@Þ}æc.lÆdcZ%{Lðé·ñ?é¶" ] Uv¢Ãæ ô8o¢õ·:»ÀÍ5oêú3n æñ¢ÞD:ßúõLtàÕQ¢M×ozÄ 6¢Nº:Ðr1 x¬¦²i04Щ7ÁóÐiðݺ:swÄÛxT¾bô0 XâhkÞu1sðt#³$-`Jm³Â<HLYz`")b1?`üfÞb}WUÔ<{yUz®^Å (K· Ï<×q5H+ лaw¡uß;= }×ç"tD,Ø ¢t~f'<?1òLLHCÆrSf®å&è Ðv{Â\`"JÙ·Í'¿/Ä Î Û j»~ÿ \5 %#É¿Þ.Dìq j¯ö;òÅK4Wðw9ÎÌ8w'¼9ÒÀíF¨Ö$ãc§JIRC9Ê|#çt #.¦ÿ {±49 iÎþµy ÇnAú¿ýÅ7ø ÓK!, JH·ØH¡Bí M /ÛÜê-æ Ý ¥[n f ¨ ÑtÓºL=:¶|=ýåEóA+ôR¿& Y[³þ} OÀ3\'m£E64çÉ³Ï fëfR ©ûC¿'ªuB1 Ð"¾Ç3 Á6`§2Êb°]lÆ&(Ò M/óÎç d^° ªº=ªü· Ý/ÿ 1b ©¤d÷ëçëð\v âM¬©l¢ I´M>ÑðÙÜ¡6 ÇÓý$b@ééj¶öU§\ää|iÑ¡|ôMB>B 'BW¼Cj¶m@ AVÈ¢ºÑÀgѵscÕei Ö^o ät.¸ W{q:&%ò)O$:ïÓÉZd´'M@Í÷J¢9Þsë*S9%þR³¸çø0Z ¾[|Ë»e²ìWt'cIm<"át½Bªµ¤Å³KYcÐö:ÒÁZ¬$q[ÅÖÑA!ãÆÒ X]ì Õ~ÅÕ ð¼ÓÖ«©&p¢ÄkCµZð e²HvݱE$Äø+î|@ðÿ ÀNÛ@ðÆ>cëlG- ÛÉ,£Å4Rï4¤ÝUCoßhñS zÑ4rtâ \9X}k·øUÔº ¯gX»0hõÿ î@òëór@«àw× H4TTè¢MIµÆÃÅvB&èÀYs@t×È@ýÃËÞR<iŠШTÑ]|¸~%-b@ehKk±4. 5 j»µÕ^YJ @7Ñ¿Êg/?daèîæðDÜè+»[5JÐhPiM?Í$4%¡ ±éIÃp,°¡ÁWöûÍá ¯þq sËmb MÎ-6à¾J%¨®Æ«±íÕ4 oÀEKQ h*PèÚ/B°éÔi¶= CCO ´¤_x« /4 SÃ&Ì¡Ó&,ñÛâÜ¢ÀeìÜ ÂúÅRõ¸¸þó´ NTuD¼ëÎû µFÊ7«A´ÚÇTãÃ&®&+ PjwÆå`<¡ÐnÕ(DË h²t¶® hº%)(ïÂ`Bf£~uÝeþÿ ÁU«q1ñs£wµÍ)-Ã]Ä i¡[4ǾM&ì ã Ü jnÈoÓ°¥ ñ0á±Dìm¬VñD+`Æl)EJh\ èrTKg³]óøÍ1ÚSà§öau i { m1 ¾b¡¹vzÝ\0 °ÓfÕ W©/ %ài@:ÏGXT *]¨u0JtÅù Að Ô Ô@CÜù!U>Õç HøüG %³kö¡öã°Õ JCÛú ©hQÄw â½d@MÕßA 6kÉ° ±(@^£´¿Ùíï=ê`2 X`õ²nWe<Ö¢ªhtìIðJùì9¡B¿ûx Ã[Á#²Ú .&9¶¢Jª ¦[ BU'Ö° θD@TÚ}ª ¼^(YeÈè+}¡¬Lêá! °åLqm°ì§V¢](l | jý-$¸b£Âû }âêK&XM]ø:Æl #xÛµÔãtu$T°´ »!ñ 5 ÂÚÐצºà7´ÖÒ.ÕoÊ¿8Bh¨öÀ?Fx1vÐíø:ãh$JD¡mÖ;~µPkI gµµ<´ ÞE.ç ;g© Шvi õÝÝCMÒ¥¿éÆý#í.° ßäCô/éÉeÖPEØAÐÂ9¨nA)TUúpH´j_6B³H P@@Z@< ÓVV¯íÛ¤ ªø2ÅFı,8`UÏ D ð /q àöÙ¸Z VÄw]· Dè>G×ÖE%Í à |ã j*Â&ÕÐãT °Ó×`ýó¾gj»ä®°[M=êÍÌ ñH<ûÂØb5g@ èM«4S`ªðÁ³è¥PZZÖ¦R¨F]Ç{Ð}G7Q)Bíß ÒoSab~ùé¬8ù$Oû¯÷ÑVÕóùEø¯¼E<"¥MBºÍ$Rªô/`¨^ Ö5ð¨ÓPZñ¸÷bºä©Oø pâ _lôaGô@È¡ÙàZ5Á@$Zе¾oª¡ªí×>»GÅÄÊbcÂR)Vü¬Êä{ óB»R D@ª(64E O³¸`4:I@Jè*å;U"@+7Í 08Noh 6¶M÷úG Fè¬DDI}Be4!¬UÁ¸qdFz*÷JÔZò®v:ëÑp@QÁûtëNè *½° ôL7m[ÍØ=Q®;ÚóXR×1Hko]o¬+RS<9ø"äÐÚM @µ©MV¦¦Æø Ȫ1G}!ãÀnmŨ*¥O±õ 4Â+`ìß ¡È ùY$E-QJsN ®5µÃWË©ô~ Î ³YµÚiòöë8$µáàXY^å¦D"U Q³ÅÍ@úMÉÈÞ´ ÖGèõj¡Fê÷í éÀ! P²þ¶ýõ-üÆtd v<×#GXé !ÐG´v\>X T!Wua lêÈnvtÀÙ?ßØãÓLM>Çö`B:=%±<©;¬pÎÔh¿m¨¿T ñ ¾8¢SE³ Ñÿ çXo"¶§ @ -¥ÓÚ ?Bªpu ¾íiÍÙ1 ÃôGk,5 @ Hé0õ´xÅf é9ÿ {Éh¨ÉDÏ>(î&n t~A{÷¬×Çàeè0¥¬Êl¸ T1 ¦êNvîÞMjyl+¼Ù#ºÌ`±P@úÍ åÚÂx î·¯O§è_ X¥gZ®º»û¦1 Ü6ÍîªÁ`ÆÄÖç; \Tܸ pV Ù\# WÁö¨!IáÒ<Ei̱Á<Ss§ßÇ£Á{Ê+kÄ4vÖ;(êØiUgmêTUÙÍMox qÏ+³^VF÷y @ § á,»H;éaßÛW.I3a$¿AwKXOÅ íFìØ _÷Ð|XQ^³mRÀ@PRrg#ÐcànÁãÂjÔ-odP ÑàéZEAH_éý,Ð é6Ci^G,ªÆRCr¼tkTqËó2ÊÓå ú X¢å t)¤)Ùc¤uÜòµU÷«Ì £PºÑlçbë,± ¡c Ýð{À |Ò yÀZ%ÜS"A*{×lØ@ÛáÞ;õàw´W»Êþ. Q(DÄ;¶×¹ºa9ZðB¦Â#£V HÂ`øSÈìX¡Jp««Zp'¾º0=â m¢î íÕ-I Ü×9ïíÏ 7 ëç \¸8$è% öï^z ÜïS&Ë¥znA» 7:G³ YÈÐ ºV»Tú ÔJ-Z8YúÝkÊ-<´4xçëÏr£Õ7 JóÂo ²`j0*¿[õ|ñÿ ó U¯Î#ÞSÞ ÂbXF:Ü]9ECuõuÜÕ=ñfÇÆϺ c¡%ã[ÆÙK©¨0ôA$Ñ'ë 3p Tíò.·IÊbnñÓã$!Õ½CK¨Ôde`ÚzÌBi4Fíßµæ\®\®8ë 5íYú |®ð h¯´NõøÉ";; tmxjùøæ @lGM¾1âûÈϧà&!*8¬O´Q×E 8SíNÑ}[/5xɪó×&85)HÇOiòo4b$nÎëYµC4Wéòw~ DW¸áWò3Ö:E10Uã§|Gab Py´aÞöc Ô? 5<QMÓ ;SOïí< ò±×oUì÷OfÊd [½0ç1ª´ú1Õ]þ)Ê{Êåq~r?ÈS °£ Q )8`$øÖ7ûË/æ¸8å<<pÜ¥8u0RînÎI Ýæ¢á@<âî AOXUËþJeÊåråråË+ü)÷ø®\\§¿ÁX·üéË+üª~üëï+ïü®S.Wùiï#>YY_Íråÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 11465 |
| Response Body - size: 11,465 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ å ¬×5æê{¬N=yT_S$ ¢Õ+kËô¨¼\±ÒnriËýÛfë fy»[._&º~vÇõåÉY,o¯Ì îËççÅØün3Lí¸KÇ/÷¬ÂÞ'XŸ{ XÛ"Jjo ±xÜÕ£h½ûÜ¡Ý ùs:ǼÛtÌ^ó6ÇͳåÒý¹~ñÓ-F··o%T K¯Ú#ù:ÔVÝI,dcYGúYï¯HôÜ¡"õ ê;G Êùz÷t½ËÁÖ¼DßJ¥@ßkªÑkÛ~g1®JÆé9 £IÊ!MMèréNÈ>Ò=ùnÁÞzçZ×z%Î;ðKïò Lì<J%û¶Ï®òÛ¸JÕ6_\ØþãynæOk·åÑoùjé´ûMáç¾òͶäì]«õcmä-MîS{ÜãAä_Kq{-@{x Wná]_ÃèÎæuɼj%ÃÉ?ÌNWª°,e±LÏlÌ£ËåZ(ÇT-]§È³zý+MØ325 OϺ¯õØvë¥^X ²ëUÒzóζo¯=ÇkõÆé7¦åä>DÃÉbrÖâȪ«W|© l;Úo±dVµù«Åÿ =e8r¥tÚ¾=Ö*Ú77LÒa Üyï¹[# +J¶]iYë7Ïxý;6ÇÍz>ÕoÞD= F¹{ãêEé¶zC*åîá¦Ö²0y&ËÕ«5®Xj Ô©=þP û_è¼mYO x}Y{/cl&L$B¯ûÝ]vÞvòcÎ̶Ií5æ IZkÚ«Z÷y|µK³ =ª®íoÂìÍMקg98À§_Æâ½nmþö»îVÂa/Åô1°êÈu+Üâ_&ñw¬öä Å7P÷)é0y> ²zu=" |ïÅU) fóç=ñ:ÙBð ÿÄ + !"@#01 3$2PAÿÚ ø:8DºW¸Â¿âZéÃ+J ¹T\« ß?¼p2^mçíÈv+®>®W¶iøñÜÎ2¨Ó&³ð¥MCìãÛWú~àÓí`+¥f{éëÍmE>óã[ Ð1\]jÖ<¶ö¶§qM±¸]ié6\.s ¹R²TÁD.5¶¤`W¹_R£¯lw'MØÅõV±"¾ÐVÈGGi²¢ &&½ñǸ}<ÄÍÝ/²ÃµtIé? K&¬±Ó&® Õ¬H7/"ÅqFé¶ ¬$&b<DÑ®©<7ßÚ¥ÇÂÒ'ql0cévB2¢$ÈÛÈT ~«> pP+Äø?îõÔìì^¢C¼dÒü¿O¢É b 5ñã A r IwEÌQÉANcø;> ÔýC¦z´ÌHÍy"ÂÐVOâ/ȦóS¹»=6ø "\«ÊæåPõÎZ (0ÅHõPxhúr/àøÊsþ±_E ³Ó}Â"fß°ºN¡oé®-³ ѯyâà8tÝT¦Á'+ÚêßSç9¸%á©ñ=¿®ôQR#º-øä{:úÃ?ÒäíuvÛi·ou°Ò¢8ÏtüÔîÞs £ÛYóM à¢`AÔV7?é»íÉCg% ¦iMß :`Qo ̤·=¾"ûÈÝò ¢sF½ÅÌjé>®Ù+g粧¹ï¤ùµzó<K9ñpm_^Ü!;Iã¹a¡£ à¨ÇõEAZi÷A¨èfÍ¥\í\îx¶0G+©YMÀÍZ7lÔÄL[Ü£ñÿ ð=ñ3MP<-´sõ éù@¤ )A7R®Ýq ¥ôóÀ;By©·Ôø¡ÅOÇKf|O$RÙæ㪠2ñç·-ý~«¤ºÃòÙÜJ׺ýc·=Äé.öWV[nI»NáÓ¿Ñ_×ä¿Sí=Py£P,æc4ÊÌ®ø5ón+TÕ8]ÏÁÓîùë¨ÌÜn¥å¶~Ê®Ê[Dë=¾¿u ©¸!¡ºÌèÎà¸ýÉLQ\Â/·Îº_ fD´[l®Ð*«2ÿ öU>Â.ú¼w dà iE«ñ [Xøörw«<ÀŦ'33ñ>v"ò7 ¡bÜí¦}«÷YÛi/î¶{¢ð½=×L¸S9e A³S¹%]µ¤Ùøº+WÐÍéA`7äTx=¨dÑ LCpØg²Ö°RW0Sn3 èX\`·ûõòÜühH\Iª³Í{wf¤²N½ÛVw\DW* ¥ßnäù.<ÍÛxU~@-9aü}6öt,%dA%±S.éøçñ1ÿ :ÝÛí ÆÀ¤îÿ âé·ïRz«Æcàÿ ÿÄ # !01 AQ"@ÿÚ ?è~ÉFû±{øÌ Q%ñÖdQ=.lðÆÄèök*T4ò# LlS,lS$Äù% ×Tu)ö] ½² È^ÉÂùD4¯Øàhõó¨zÄ8ÞÕ²Ù½²,ÔWýtéÊÐö¦ìÆÐt' 5ïævJi"2Ì¡ì ø4VòV8µóRkdèøËd¬Hhq£râ×V±.J£!³ÉúgÎÓ×Ztd) vf?btìòväÄÉOüqCéÿÄ + !10A"Q #23@BaÿÚ ?ìK0±hQKÚýÞ³?>é{ãyòæÚ}]4ä.;oåO!nÕ=uiB¼ ò F%9ÃÁR;Êl^&q[ëµUWÐ*jÑ"æÖYY4®© "ëíý¢mÂk®W§Õt]gpP7ØìÍBù$Ë-) tNM¢<¡ÜÜÐVMùiøo)¦Åz}xgñI©®,7ÊÂÙ:Hp¸ýê© C-åGéÍ2Ô±[SÉôîS%s>¬í§4;!Á È@÷Xq~ÌÛJåz]^C¤îÍm%|©Æ$&ïE9ìéâ[¿´Ç¢Å× ¤5×QÔôä. Yz§7(ìк'âýñ**ÉéE3%aýÞÐábªáÅCIw`UMb T¼ßí A3ém¥8¹ÃñÂÞ-A§vWM©Ä4 wÂ×ò¬Ø ,TÔ· ®jÿ TÑu áµÑuþ)ÑÊx+Ú_ MIó v½J<à?ñr-ò>*6اB\.ÜMµ¸»Q§»6°ÄÝA¬þÛÛq)°ZáIc7u > £N,ÐØ ÜJ4Mît{©ãÊ ðå` ¿Êcqìÿ ÿÄ ; !1A"Qa 2@q¡ð0BR±ÁÑ#Pá3br$CñÿÚ ?ê.s0(Dn+cCHÎ?ekíI'<(òM¢H¡Eºiû<L£ ÎöiMT ³ Ø+Jp05ÍÊX ôݵ¼£Ð40^!ÂðÖ %?uܯ³¶£6ÞQ s ð¶«ÅKPOL:hȤȧW`vR©Í³hÍÚbyU³ðM-ɹ[«-Êê\õ¬y'sV Ò5¯ ¬1Å5Áùi¬¡ªßDXÖÝP©ÕOIÔg"\ Æmº@Hùí?í,³lvz©ÌK{Ù³ÃDÛW à¶Â¢¥e%« ¨ë¥´RÂéXwÓûQîràá ÌpÙ¿©Èp × ¥ ìR×(´i ó0¸lü< Þt7³!hܱT ÉöV Ó Ì6cÎ=ð6eÂÚ!Âs_§h?ÅÙán#0¦*°¸QrÎ æRéÃMú,Lç0æ¸v!oa £ûC¢e`ç`´´B ×W {1Gt£ëïCìÜC U]ÐÊcì Ó§Çòöèrï@Ù 6äÛFÿ UºqÔ áºU<Óc¾îYãoÝÃù®ñ@Ü;3É»zÄòK´¤-ába¦ìQc;qNf}e¨Þ°3´ÕiµAÄ }£ZpjÒuíAögbÔx8 DöhvßTë3ÑuZxúªã¯2©³ÐtPW'jz*X*·°KÚd{ðæ'>ÑÝ-\ù,È Ë{8Åb`¸ ¼°øsß ¾.¡æ87=;V!Ä×Cëét|M½Í︷ Äx Ë §Ly©W*Ѳüû}}úº¬¡ìÐý¼ìÏAßçê¬DÖ Ó5ÊìL1h<ûQÑÍé3PTT*cÿ MâÆ¿Ô yÇVr±îú^Óܸ«"]¯"¨jØ}Ô ³ êÚÆÒ¾¼ú9¦Pe¤HáYé'o×aùë Õú^ fbѾ|´láÉÃQëÖjnå¬ÀfÑÓÛ:ì;©t.ò(ÎBz[ÂÒ6Pë8ó ×bÓ ý3»rÇdÏÓ.Ü ·³jÑGG¿6ÈÕªÎ3ÅõAq_eÊ7hD8oBÈifíâè5µÙôDëÿ W\¯#}Ä|ÕçÚXZ¶Zê¦Y²ÑLUrþÎßøîÏûOãß70lÌþ.ÔìJ d0¬Ã3vª- 2y±k8JÅñj.l|b??kâP<É¡¸åu0¸nÈ¢* 3ðñ~xr_³Å:ÍÔ y; ñü«ò+AïsÙ9 I;Í9¦âÐEÜ©ý3[2w0î3wxú¦ösK45 >·Pá !ã1yfµä ì+³éµmX´±Ç nô`@ÝÔ £2â jÑRwÿ ñælT]ÅURPɶ)קjóºZaDZL½´þ Ó³ÿ ½L! K;YíóDY44 Ã_EY§öß÷º&ÑÛÔ nÞ.ÚñX\xö¬*Óg&a¤y¬mqÞªIêÄ3£uõO5Lôív§÷®ô÷M4TRT®Q®Aã#X§e6ÓàuBiNÉÀ0a[}Ygý?5³¥B;½+èWöÅ ¬-Ý wEß)Xg£D?Á íÙêà¡hÚòiæ£uƼÔ`íBQÌç¼)³;':i´vN`³iKNÄ\zìí:9pÕÎ0sE;Ê깫H˾þ aÕMk{{E»!l Ù\ ÐrÅg]?)¶u ×yê_ÿÄ * !1AQaq¡±Ñð@Á 0áñPÿÚ ?!ûw38fXAÔ"oÏþ*àÚ TÛ&³¤½Òs´Vú'þaq¥Bè] @¶f: L× ½MqçÖj[ÉFMOxàgxWÓ 3÷кñ3ÑTÝ"êÚ \`¤QPF¸äk+¨kרsÒv Än0UFÍ%¬ o§ff?ì¢à §O·/äLÁ*Òi®#§BàùÇXî`0¼Kä7ᬹ1/ZÀ¢W Ý o§TZB½´© E¡Dx#dAøM@Òxu>Ù¤{.+êæ¨ 2\Lx@²§BA9IeH ³4twU§hP)¤ýÍ{³FaÀ ©w#øÌ ®0éìÊ8Q°øî §¬%ùGcoöö YW2¬5öÊÜõ[lÊÕuÃï´Ç¤{MP9MþvÚCÑ9 ¥ QÔÙÀ5ÑsPbe¦³ 8tÔâ`sáÖPEú*^³öö EÊQåíÇ\¢ÉÐ_ÙÖøèÊø¯´¸K7úÀ~e væ !Åq¤ªKe½ÏÜÄ»ÀòÓÒ.÷ã)É(ú*5 mXNÓ4÷ Ô´üChjF CW3<{öþCKF¸þìòHeñÒcj¨[Äë¹à·¤Ê&6fY"Õ1q=§³Zd6üW Vc©*XÉ°B;·ónCMR'ñ£o¶¹X¨]©Ì:S0ý#U(¤fö LñRÝÖ {ÂØ#Ö8 G¯ýþ×pF [8Q±wÞ¢±<Øo]ZixUÉSe!åV4{sÛ^.¢ Å)`y^C4Å, £/].Xc]ÑcßËéi©ÞFÎ ?]:âÿ ßãØG03 ²X½ê_MT$.Äáý> Pj_ÄÆnfàúÄ<o°ÓÜéON<<?¸Ò¶ÇÖõ¼§}üe½@¼lF½c-y¶}| }\ñàc£Â2¿s÷zÁ©jÛèb'Ìo _<N÷æé*×Gñ 8H`)î}7 ª¹iFË g«ý>t[R|xÃhFðÀ kGrZ½õ+{£ÇûÜB¸md`0[ÃÙÒ Á;|\ËR-¡a ÛÇ«EÕÀÃÓêµ/½ì <Èt¸Äl5 ½#Ä//púìí pÿ ·/¨éoó )ÉÎÄlÊøªÍiÔ@H#¢oô"¬J×Öâ³ê}oê?B0;T ë:û03 KòÉ«àîÝ Y\êÿ 0åjÃóËHîräÍü\ M¹Ëìló¿dh ,ïÕïá8ú,«·ßfPº c-ãJôÀ©õûfÔÌá®9óü,µ§gÑóý Q ÉìxÂ1w®Pí kB»¤×ì´mÍH4·UÜ&ÆqO^¡ôA¬M¯ÃIC68¹x}NøºL`ltO e¡©sã×µÂ!oUôÎáO? <pY£¬¬tÚü¿Ã¨¿¤ºÖ½xËuu7´©øW'â{ÃHáîÇz¿È¬e@Ù ìã<rØ2v5ü0òrté·§÷e{ùIsHmáª35^%ÅhÃ(NO7hè¯söóp¿F;FB!Hï*UÆÍ[ZWÒ¡Ø5qwäüÇÕÈiÖV= ×Ðj\Ò?Ad5Ç ïÏã è¼]¹é3Í éñÇ÷!Ö$¨3bª·¤FXÇBWÍîMEÞð£ç¢N~~b¶Æ/Ãûë F.Ñ:Æi9ënøùÒ5:¯ZL/è.¹ý <oÙ 1/ßÂÓà ãèÎ÷¹õ.öß}Þþaò²3,ë¿?5ÔU;çR, ªð6öÍú4ÉUJ4_ ·ö¿ËL~à,6Û&bW¢ qE8¢|¦!àÓÚ=s¹5¯<¦ÑÐß äßE¨»Ì£Q&cQAâ©! DSPU'Î4 ^IÑù¤3¦h¹tÝ}¬ÝvQwÔ º¸+CÒå¬JÕ:@Rô, Y8j¨ Ñ¡üA |È FZJvxñÌèêË»ïH¼oÒ à-f2ûDÄDz7 ¯Bh¿ä_¶µÛ]PuÉ\Rdâvõ%ÜÊ¡ÑêéÈÓ?'ÙªL¡#ð|´»~\Þ()zðô~d÷z¥H5G<³ÁM¸zJ©õ?0|;aB_Uá ÛZ}íûþeçUCÕù©í§6F; ùùÓ[C¬óØ~Ñŵ¶yv|^ÍY¡Ü²V>4Hà oëÝÍOù°ÝJ»Êa>aó§¡*äi ñ§Oû×3I·(@æ.\tzÞÑÔcÕÊ]dðf õí M%Ù zßXyZ}¶X6V³v¼ ø@²Ú=Ôî·´;Ìr áúòç ª*H(6ôÛÊZ]GLµÒA¡:2æÆQZgü>ÐÖÞ{ÞÏxKð_·«5;û¥¬³÷iPàñ µN®L.¦B¾?w00Äw D êÊ´üàªa.ë/xv%° ¿pÙ»îzz)Æ«¶ß§´Fë ¤C 6/ë¢ ðÿ à$S2Üì[7_ööñ"NÑ¡« ´« ¶Ýñ úhºeíôÒi×aÁV peù°}ÿÚ óÏ<óÏ<Æ/üóÏ<óÏ<óÎ2û¯à¿ÿ óÏ<óÏ<óÎI©Ýh¡tóÏ<óÏ<ð)Ù×,&Ì6vÿ ͼóÏ<ò7ëDj9ßþ~o¦óÏ<óÇäÌ\ÎB-!3óÏ<óÏ<æ ³JKG<óÏ<¹ä+]iPZnE¼óÏ<ðÃn¦³¥%ª¨£+|óÏ<óÏ<"¡Wu"òug¼óÏ<óÏ<æ$ü{¾Ï<óÏ<óÏ<òõÝ[Ï<óÏ<óÏ<óÏ<óÀ¾óÏ<óÏ<ÿÄ !10A Qa@ÿÚ ?ð.ÄÇù|òçc L9h¤#L`@:u Ù"NÅÆ.S÷ÄG!êÀq.ߤÚX@õð¸Ã²Láðúnc@!)o6N?/ê¯ÓÉ¿ÙNö+ÜÇ￬ àñk2CÕ®þ exH]ÛÝ#ÿ ¾Áì03 <[<° äþ]¤GF̧sîE¤ m ê 6óHORËÌ l ]OèXñ¹dûõ¶²-#9°-,rwcÌpzm8a}O{Ûâ}l°È[" Z \ énõk¾6ãñ`hÈåÔÏ9Ë®ù82÷ L9þ5SÖZïÿÄ ) !1AQað0q¡±ÁÑ áñ@ÿÚ ?ì¨é,íDÞ äYcEº#G ¼DE sú:OgTÌI¹£F{GrMGÆ:ÜRÖ nå;د O~É7ã2+hIJ:A«á2O]}ÁYG\P4Vâ¥î{!¾Á~ Ø ÐË.¿:IÞìs]ØÉåQ°àºë§Æм¸º|'¿÷÷©É8% íÁä÷Êñã58-L ×îCk_#IüÞx Î}ÛãéÚÎÖ9 ðvîÎòÔbâT¥1 Õ¨èõÇX%q5ïó3Ƚ? Ãç¯DâfA ò¸¥ôx'Uμùû8ÄiõØÝé{ ©~kí¤Aò߶¼&é³ Gj¥Ó¿o=>³.øÐSJ~ûï2è²ë÷ÕxÄ-'®½j *4àþ¹øLá¤yèìîL?5rÄXHâ8°BnôðçÄõ<#HêA þ&r*+Þ'̵°ôúö7FúÏ×Ì2l`Lä½ùubÆÅÝ/¿8À² ß Ê~å¥Î'¯â+¢\¤É0µÜ Ê£8W]tLW z HEڴ׿övHZ1PµÇG¯ W=&RnLãHSÒc¦Ý»ùAutHKi(ì ´ 8ÊJзå.·#Èí\½`Û´Q×,±¶ï êà*ñEÄq4BØÿ ÿÄ * !1AQaq@¡±Ñð 0ÁPñáÿÚ ?üc £ ûYkÜe+JqÈw6<a `^ vG-ëÿ ô¥_:L¦í¶«8®ÛÕ¼¦¸ÈsOBoX$©6(Ôx|å§C½kÃ`3 5Gÿ p ABeý8ä7Æ<½3í ÿ TÀ9\²ºP4vlÂ4mõðþóË8ûÏëÞÿ Èÿ |à «- çgt=oh]Âr=þ`ÁHÀ¼æýP!ö'©ì7eI©©§ÏÜ3¸H½÷ø¤å@èö½öLãRù>qJ46Ð]v ¨ ¨¸ zß5ÄÕ+OÛ¬¼jjÔù>·ñÔ! ÿ MÚÌZ ®, O{~¸)Dt× ë[;T hòü¹(NÂ3¯Y Iê÷íÓ¿¦R á³ 0Æ*xÁýüxp& »AËãöp1IôkëB'l\È:§&-8"áûîð³J×;>ücDlÂÜ]1¦ë6Õ¸UM?|c6¥uæ,8 -sº¯F¹ü³-Rs WÕ>r!Ä[ØÖÿ Q?¦_ì [xý?û$:í® $ÑàÃDDÐ[&ü fýJ#Èe>:Ö¦ÂJØx5Чê>#õÆ@±¬A!TþíßQ :Øò_êbùK¼&Áã¦G øQP¿Wì$møìDM8ÌEý^¼&& âèxÜþ`5ô"oÐ¯Ê iúÔð]² u¾*ë 75³W½ÆkÊQaa¯¥øyÍ=½@Eñÿ 1AFqÄÂ&ó ëÉä ¦í åAz#VÎÒµ$! W ¡>AÈäÞ)Û¯ v Ñùn5ë%ùÛá#õ<eôN2ÿ ìç¿8@EJ¼3P<ë4 0^ðùÛÎÅ"îGj®w«£ÞÚz26w®þúá7] Ãf®²_É(«K>ô ¯Æ«Q§8ù5¤ô} &7ÐHG± º TR>7Ó õI _N dÞZírxüÿ 9fón![uMÙÖÞ|}.Jó® 7M` <M°7ÄH>WìY$wèÌdh~²ßÖE¦ãÙÔÉQ±ÛÇVÙiD=Iüà*ÍqÀFrÖè¿|sþ>ó û"+=ö#ŧ8Ü88 ÄÁèoq°íÜاÌ˦HÑwç4Oa»è 5X¯ßHö#Þ Ï¨i{ýp4cGȱ ±)X'1AÂ* ¶P¹¥µ¾ÛßÏý ³&Êp§®ÍyÆU;ó¨L ALØ1äX{rà À7ß\±>åéÿ %·ü®:o6L6>áìûw»MAY§£È]Øljt ë+Ñ ¢ø0` R *øAÞõ ¾]ö:Ízʪy%Ñï·¿/ö%ª"pë £©ÕdǶ5Õ¨«i׫TÄÐEî#Å)GÒd)É^µ«|n)iHDu¤MXóc Û¸ÐÀýC zæ-Lé¾·O¼Õz>|`(uϬA;¾Giá{8yÓj$zgý¾áø-1*¨*ÖÄUMùR âcRöØóþ; Qûbó¤¢SñöK:úây ï>|óç lÐ$:lú!Zy8@|°¿hðÓß) §CÈts47 £È Ro]ç=FÆ»wþç $¬ýû`ùÐ3Èèh®ß L¬Ö h6NuÂt átî ªÅÙjV¬ßF+qãÞñ:£Gn¸+m=~µõÂ.ÓHðå¨õãðJ< K¥Fø^#\'KÜà oI %?%뫵àQÎseeTÛØ¯Þ Ô ÔÁNlì§O5Lmöùx?;÷ &Hã`ÑÊàñ{?¼ï °TS iKFÂÿ ¾]¢¬ÙÀðq/@¦ CÒüÜ>xFÇ L i*ÔUND×`-½MúCBrñ.+Âr>Ggxoðb3n%(Q*Ùà 1fÜ0ié^àmløÀæ§ýOü @C£÷ õÆÙÎRH« [`®¼{Ä>ññh ô61äãDyHk÷rS¤¤=ÅTcã#/XGë:Ð °"»UÚò \ßÁêu) 6ã7¡^'~GJ_Lò`mTí EYB1wK>°¸1À9aFÛòV%pdâ!(ìÑ6''²Q³H">ÀýsEO¤)ò:q u± ¸VC$h A¨-ý£õÈ÷Vü ýÃÀøëøúa 9 P\ò×" Âü3R¦ÅÙñqE¼ôÁ= tW3e²'ÈìÇ `°^Å|¸(pÿ G»Ùß[ 8Y(ã{,êYöî ¥ZàFª4[%! AE Æ~CFв2°§XQî : ÞQÑÙ@^JiÐüÐW\Á¥1ý¡ç¥Öw¥ Ô7ÈÄðû/HÀðº-£` D#ßá%X¸:- 1tå69&µ*ÍÌõø(êYÈ7âk/xCsiS³Á6?|nקC×Ù±ï *hç)>¸¥7ygr8ìÆ ð\÷A Óé:¸gÆ^ÓÁùN>í· >§Èd D¯ K3Ú"5yÒÑÐéq5ÙD ©×fͤkO.[/ûÀ1ÆDU×0tjÞ?_¾-%$+¥ 2ñÄpõ¯òu8Ý~N ±^öKÐnV#½ '¥Å:aè "vc8Å{:Q®0±°½§½ððíø¦þ_Ö?\ xc£Cföö£4{ÄTc(ǬBÓ_°ò ÷ë¥y<!ºy23y´$ØZ{Õ¡¢c÷\Jè©6jr 5£þÑ®§Ù,%ÓUy×˵«|M[Ûiüâ®jõ)§àßÕÄ ½éDù³Õeo³|vþs 2vT)µäª,Óéw!þ 95ìw÷G>Ì"YBE£rù5Õü )Ý·É:{BÉH)ðÒ{1_ò¨ ]ÎO¨§×u¼³|&ó]ëYNÈùÊeªSáxbð誳¡iD£ñÎô I<ø>¡ÆuÙ8û¸ .°Ì3IØ7%.F»^³$DÙi) R¨(&êÁÆÔ©Uá¨6û8»gÑäÎ%(ûñÇ(vº ¦Z]xçð I¯5¿¹xéãMÒà ½nç ³gî}Mý2#ÓÀ;ºÕà ` K FÄ{x.ªTç Hûüw[ÉõÁA,LÙIðÇñ1Ø<¯ÎT¸Ò#^¿Î*ªlr*WË-?#´æ;:¸4 8ÃfQXO O¼WÓ°¹?½L`"%`8+âßY-Ôìår>F aÎBJÝuÄÁ® èl÷þÕ¨µ þ&H¤äjº`Ûûñí`¨`y MñX-ãõÏbÿ » !¡AÀ¨aÆä\"Ò1À2tññõ9$¯IÁ ß6\J IýÆzL-¤4ë ðµ®B:gX Bð=sý÷GéV¥.Î>q¢ìÅ>áÖÓCåÖöªÖ÷ û]¯É¼@¥ÀÆA;®`U] Û Ydß!D!eàâ.¿ùGCõþk=xÎ 5rAü bòõ ÇÔ$Êä ª9kr¨çoßùÊÎOyð[Þ"X¯üï¼tc©ÕtøçÕQ¬\^XÓ°Û ³¿¶)ÊPý& ±F©ïÃüà^ÜMtʳgǨ6¯Ýûäm'gå5E<TF ÉS-àì Zðý1ëpÃúùÃ¥×ú8Á =lä¶.ÝðhØxÀÈÑ'¬}!7¬1%z®äSæ¼l+â*¼Â ¶Dqµµð8ã¶`mGef¢l"'©®NúpØÃÉámà§aåØâ¡üfò¨n´³n_çxÑL4 × è )?ÏG ¯/è}¿,\ 1dÎYBz9>R¯6çgõÄáhln pßE^Z»: N¿''yÍèó6Öâ7÷1Ã`'NÃÛôÄÕJá¾þ¿¦H ^×7çIï (6 \²ÝÒ+Á~ cB]]Ý Ó¦¢x1p*µ;aè8 måØý.ÀBñG7ÇR'Y i˽»À(G?Ö*ÃÔg,ªâõ§¼Á ©×ÆYÒ8|:ÍA¨¶Y/`¡ ¶þN 5 H¯Z0ÂT<¦ò"/ Aê;C¡Ò {ûúÁ"`5CÎirzæ öÌ£SFÏ~Æ é $'ÑÏvñÂyuña°k þ¦ ê¢ÉÓGýçÖi+i»÷ò~ÙÖí À(Àd¿oü0 3Iáðñª¡«¢;Ou¹ _F¸ºÞøÁK'-^8¯+ÿ Ièrøç¼ìPÙk>Çÿ Íä¦b l ìY_Èÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 11465 |
| Response Body - size: 11,465 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ å ¬×5æê{¬N=yT_S$ ¢Õ+kËô¨¼\±ÒnriËýÛfë fy»[._&º~vÇõåÉY,o¯Ì îËççÅØün3Lí¸KÇ/÷¬ÂÞ'XŸ{ XÛ"Jjo ±xÜÕ£h½ûÜ¡Ý ùs:ǼÛtÌ^ó6ÇͳåÒý¹~ñÓ-F··o%T K¯Ú#ù:ÔVÝI,dcYGúYï¯HôÜ¡"õ ê;G Êùz÷t½ËÁÖ¼DßJ¥@ßkªÑkÛ~g1®JÆé9 £IÊ!MMèréNÈ>Ò=ùnÁÞzçZ×z%Î;ðKïò Lì<J%û¶Ï®òÛ¸JÕ6_\ØþãynæOk·åÑoùjé´ûMáç¾òͶäì]«õcmä-MîS{ÜãAä_Kq{-@{x Wná]_ÃèÎæuɼj%ÃÉ?ÌNWª°,e±LÏlÌ£ËåZ(ÇT-]§È³zý+MØ325 OϺ¯õØvë¥^X ²ëUÒzóζo¯=ÇkõÆé7¦åä>DÃÉbrÖâȪ«W|© l;Úo±dVµù«Åÿ =e8r¥tÚ¾=Ö*Ú77LÒa Üyï¹[# +J¶]iYë7Ïxý;6ÇÍz>ÕoÞD= F¹{ãêEé¶zC*åîá¦Ö²0y&ËÕ«5®Xj Ô©=þP û_è¼mYO x}Y{/cl&L$B¯ûÝ]vÞvòcÎ̶Ií5æ IZkÚ«Z÷y|µK³ =ª®íoÂìÍMקg98À§_Æâ½nmþö»îVÂa/Åô1°êÈu+Üâ_&ñw¬öä Å7P÷)é0y> ²zu=" |ïÅU) fóç=ñ:ÙBð ÿÄ + !"@#01 3$2PAÿÚ ø:8DºW¸Â¿âZéÃ+J ¹T\« ß?¼p2^mçíÈv+®>®W¶iøñÜÎ2¨Ó&³ð¥MCìãÛWú~àÓí`+¥f{éëÍmE>óã[ Ð1\]jÖ<¶ö¶§qM±¸]ié6\.s ¹R²TÁD.5¶¤`W¹_R£¯lw'MØÅõV±"¾ÐVÈGGi²¢ &&½ñǸ}<ÄÍÝ/²ÃµtIé? K&¬±Ó&® Õ¬H7/"ÅqFé¶ ¬$&b<DÑ®©<7ßÚ¥ÇÂÒ'ql0cévB2¢$ÈÛÈT ~«> pP+Äø?îõÔìì^¢C¼dÒü¿O¢É b 5ñã A r IwEÌQÉANcø;> ÔýC¦z´ÌHÍy"ÂÐVOâ/ȦóS¹»=6ø "\«ÊæåPõÎZ (0ÅHõPxhúr/àøÊsþ±_E ³Ó}Â"fß°ºN¡oé®-³ ѯyâà8tÝT¦Á'+ÚêßSç9¸%á©ñ=¿®ôQR#º-øä{:úÃ?ÒäíuvÛi·ou°Ò¢8ÏtüÔîÞs £ÛYóM à¢`AÔV7?é»íÉCg% ¦iMß :`Qo ̤·=¾"ûÈÝò ¢sF½ÅÌjé>®Ù+g粧¹ï¤ùµzó<K9ñpm_^Ü!;Iã¹a¡£ à¨ÇõEAZi÷A¨èfÍ¥\í\îx¶0G+©YMÀÍZ7lÔÄL[Ü£ñÿ ð=ñ3MP<-´sõ éù@¤ )A7R®Ýq ¥ôóÀ;By©·Ôø¡ÅOÇKf|O$RÙæ㪠2ñç·-ý~«¤ºÃòÙÜJ׺ýc·=Äé.öWV[nI»NáÓ¿Ñ_×ä¿Sí=Py£P,æc4ÊÌ®ø5ón+TÕ8]ÏÁÓîùë¨ÌÜn¥å¶~Ê®Ê[Dë=¾¿u ©¸!¡ºÌèÎà¸ýÉLQ\Â/·Îº_ fD´[l®Ð*«2ÿ öU>Â.ú¼w dà iE«ñ [Xøörw«<ÀŦ'33ñ>v"ò7 ¡bÜí¦}«÷YÛi/î¶{¢ð½=×L¸S9e A³S¹%]µ¤Ùøº+WÐÍéA`7äTx=¨dÑ LCpØg²Ö°RW0Sn3 èX\`·ûõòÜühH\Iª³Í{wf¤²N½ÛVw\DW* ¥ßnäù.<ÍÛxU~@-9aü}6öt,%dA%±S.éøçñ1ÿ :ÝÛí ÆÀ¤îÿ âé·ïRz«Æcàÿ ÿÄ # !01 AQ"@ÿÚ ?è~ÉFû±{øÌ Q%ñÖdQ=.lðÆÄèök*T4ò# LlS,lS$Äù% ×Tu)ö] ½² È^ÉÂùD4¯Øàhõó¨zÄ8ÞÕ²Ù½²,ÔWýtéÊÐö¦ìÆÐt' 5ïævJi"2Ì¡ì ø4VòV8µóRkdèøËd¬Hhq£râ×V±.J£!³ÉúgÎÓ×Ztd) vf?btìòväÄÉOüqCéÿÄ + !10A"Q #23@BaÿÚ ?ìK0±hQKÚýÞ³?>é{ãyòæÚ}]4ä.;oåO!nÕ=uiB¼ ò F%9ÃÁR;Êl^&q[ëµUWÐ*jÑ"æÖYY4®© "ëíý¢mÂk®W§Õt]gpP7ØìÍBù$Ë-) tNM¢<¡ÜÜÐVMùiøo)¦Åz}xgñI©®,7ÊÂÙ:Hp¸ýê© C-åGéÍ2Ô±[SÉôîS%s>¬í§4;!Á È@÷Xq~ÌÛJåz]^C¤îÍm%|©Æ$&ïE9ìéâ[¿´Ç¢Å× ¤5×QÔôä. Yz§7(ìк'âýñ**ÉéE3%aýÞÐábªáÅCIw`UMb T¼ßí A3ém¥8¹ÃñÂÞ-A§vWM©Ä4 wÂ×ò¬Ø ,TÔ· ®jÿ TÑu áµÑuþ)ÑÊx+Ú_ MIó v½J<à?ñr-ò>*6اB\.ÜMµ¸»Q§»6°ÄÝA¬þÛÛq)°ZáIc7u > £N,ÐØ ÜJ4Mît{©ãÊ ðå` ¿Êcqìÿ ÿÄ ; !1A"Qa 2@q¡ð0BR±ÁÑ#Pá3br$CñÿÚ ?ê.s0(Dn+cCHÎ?ekíI'<(òM¢H¡Eºiû<L£ ÎöiMT ³ Ø+Jp05ÍÊX ôݵ¼£Ð40^!ÂðÖ %?uܯ³¶£6ÞQ s ð¶«ÅKPOL:hȤȧW`vR©Í³hÍÚbyU³ðM-ɹ[«-Êê\õ¬y'sV Ò5¯ ¬1Å5Áùi¬¡ªßDXÖÝP©ÕOIÔg"\ Æmº@Hùí?í,³lvz©ÌK{Ù³ÃDÛW à¶Â¢¥e%« ¨ë¥´RÂéXwÓûQîràá ÌpÙ¿©Èp × ¥ ìR×(´i ó0¸lü< Þt7³!hܱT ÉöV Ó Ì6cÎ=ð6eÂÚ!Âs_§h?ÅÙán#0¦*°¸QrÎ æRéÃMú,Lç0æ¸v!oa £ûC¢e`ç`´´B ×W {1Gt£ëïCìÜC U]ÐÊcì Ó§Çòöèrï@Ù 6äÛFÿ UºqÔ áºU<Óc¾îYãoÝÃù®ñ@Ü;3É»zÄòK´¤-ába¦ìQc;qNf}e¨Þ°3´ÕiµAÄ }£ZpjÒuíAögbÔx8 DöhvßTë3ÑuZxúªã¯2©³ÐtPW'jz*X*·°KÚd{ðæ'>ÑÝ-\ù,È Ë{8Åb`¸ ¼°øsß ¾.¡æ87=;V!Ä×Cëét|M½Í︷ Äx Ë §Ly©W*Ѳüû}}úº¬¡ìÐý¼ìÏAßçê¬DÖ Ó5ÊìL1h<ûQÑÍé3PTT*cÿ MâÆ¿Ô yÇVr±îú^Óܸ«"]¯"¨jØ}Ô ³ êÚÆÒ¾¼ú9¦Pe¤HáYé'o×aùë Õú^ fbѾ|´láÉÃQëÖjnå¬ÀfÑÓÛ:ì;©t.ò(ÎBz[ÂÒ6Pë8ó ×bÓ ý3»rÇdÏÓ.Ü ·³jÑGG¿6ÈÕªÎ3ÅõAq_eÊ7hD8oBÈifíâè5µÙôDëÿ W\¯#}Ä|ÕçÚXZ¶Zê¦Y²ÑLUrþÎßøîÏûOãß70lÌþ.ÔìJ d0¬Ã3vª- 2y±k8JÅñj.l|b??kâP<É¡¸åu0¸nÈ¢* 3ðñ~xr_³Å:ÍÔ y; ñü«ò+AïsÙ9 I;Í9¦âÐEÜ©ý3[2w0î3wxú¦ösK45 >·Pá !ã1yfµä ì+³éµmX´±Ç nô`@ÝÔ £2â jÑRwÿ ñælT]ÅURPɶ)קjóºZaDZL½´þ Ó³ÿ ½L! K;YíóDY44 Ã_EY§öß÷º&ÑÛÔ nÞ.ÚñX\xö¬*Óg&a¤y¬mqÞªIêÄ3£uõO5Lôív§÷®ô÷M4TRT®Q®Aã#X§e6ÓàuBiNÉÀ0a[}Ygý?5³¥B;½+èWöÅ ¬-Ý wEß)Xg£D?Á íÙêà¡hÚòiæ£uƼÔ`íBQÌç¼)³;':i´vN`³iKNÄ\zìí:9pÕÎ0sE;Ê깫H˾þ aÕMk{{E»!l Ù\ ÐrÅg]?)¶u ×yê_ÿÄ * !1AQaq¡±Ñð@Á 0áñPÿÚ ?!ûw38fXAÔ"oÏþ*àÚ TÛ&³¤½Òs´Vú'þaq¥Bè] @¶f: L× ½MqçÖj[ÉFMOxàgxWÓ 3÷кñ3ÑTÝ"êÚ \`¤QPF¸äk+¨kרsÒv Än0UFÍ%¬ o§ff?ì¢à §O·/äLÁ*Òi®#§BàùÇXî`0¼Kä7ᬹ1/ZÀ¢W Ý o§TZB½´© E¡Dx#dAøM@Òxu>Ù¤{.+êæ¨ 2\Lx@²§BA9IeH ³4twU§hP)¤ýÍ{³FaÀ ©w#øÌ ®0éìÊ8Q°øî §¬%ùGcoöö YW2¬5öÊÜõ[lÊÕuÃï´Ç¤{MP9MþvÚCÑ9 ¥ QÔÙÀ5ÑsPbe¦³ 8tÔâ`sáÖPEú*^³öö EÊQåíÇ\¢ÉÐ_ÙÖøèÊø¯´¸K7úÀ~e væ !Åq¤ªKe½ÏÜÄ»ÀòÓÒ.÷ã)É(ú*5 mXNÓ4÷ Ô´üChjF CW3<{öþCKF¸þìòHeñÒcj¨[Äë¹à·¤Ê&6fY"Õ1q=§³Zd6üW Vc©*XÉ°B;·ónCMR'ñ£o¶¹X¨]©Ì:S0ý#U(¤fö LñRÝÖ {ÂØ#Ö8 G¯ýþ×pF [8Q±wÞ¢±<Øo]ZixUÉSe!åV4{sÛ^.¢ Å)`y^C4Å, £/].Xc]ÑcßËéi©ÞFÎ ?]:âÿ ßãØG03 ²X½ê_MT$.Äáý> Pj_ÄÆnfàúÄ<o°ÓÜéON<<?¸Ò¶ÇÖõ¼§}üe½@¼lF½c-y¶}| }\ñàc£Â2¿s÷zÁ©jÛèb'Ìo _<N÷æé*×Gñ 8H`)î}7 ª¹iFË g«ý>t[R|xÃhFðÀ kGrZ½õ+{£ÇûÜB¸md`0[ÃÙÒ Á;|\ËR-¡a ÛÇ«EÕÀÃÓêµ/½ì <Èt¸Äl5 ½#Ä//púìí pÿ ·/¨éoó )ÉÎÄlÊøªÍiÔ@H#¢oô"¬J×Öâ³ê}oê?B0;T ë:û03 KòÉ«àîÝ Y\êÿ 0åjÃóËHîräÍü\ M¹Ëìló¿dh ,ïÕïá8ú,«·ßfPº c-ãJôÀ©õûfÔÌá®9óü,µ§gÑóý Q ÉìxÂ1w®Pí kB»¤×ì´mÍH4·UÜ&ÆqO^¡ôA¬M¯ÃIC68¹x}NøºL`ltO e¡©sã×µÂ!oUôÎáO? <pY£¬¬tÚü¿Ã¨¿¤ºÖ½xËuu7´©øW'â{ÃHáîÇz¿È¬e@Ù ìã<rØ2v5ü0òrté·§÷e{ùIsHmáª35^%ÅhÃ(NO7hè¯söóp¿F;FB!Hï*UÆÍ[ZWÒ¡Ø5qwäüÇÕÈiÖV= ×Ðj\Ò?Ad5Ç ïÏã è¼]¹é3Í éñÇ÷!Ö$¨3bª·¤FXÇBWÍîMEÞð£ç¢N~~b¶Æ/Ãûë F.Ñ:Æi9ënøùÒ5:¯ZL/è.¹ý <oÙ 1/ßÂÓà ãèÎ÷¹õ.öß}Þþaò²3,ë¿?5ÔU;çR, ªð6öÍú4ÉUJ4_ ·ö¿ËL~à,6Û&bW¢ qE8¢|¦!àÓÚ=s¹5¯<¦ÑÐß äßE¨»Ì£Q&cQAâ©! DSPU'Î4 ^IÑù¤3¦h¹tÝ}¬ÝvQwÔ º¸+CÒå¬JÕ:@Rô, Y8j¨ Ñ¡üA |È FZJvxñÌèêË»ïH¼oÒ à-f2ûDÄDz7 ¯Bh¿ä_¶µÛ]PuÉ\Rdâvõ%ÜÊ¡ÑêéÈÓ?'ÙªL¡#ð|´»~\Þ()zðô~d÷z¥H5G<³ÁM¸zJ©õ?0|;aB_Uá ÛZ}íûþeçUCÕù©í§6F; ùùÓ[C¬óØ~Ñŵ¶yv|^ÍY¡Ü²V>4Hà oëÝÍOù°ÝJ»Êa>aó§¡*äi ñ§Oû×3I·(@æ.\tzÞÑÔcÕÊ]dðf õí M%Ù zßXyZ}¶X6V³v¼ ø@²Ú=Ôî·´;Ìr áúòç ª*H(6ôÛÊZ]GLµÒA¡:2æÆQZgü>ÐÖÞ{ÞÏxKð_·«5;û¥¬³÷iPàñ µN®L.¦B¾?w00Äw D êÊ´üàªa.ë/xv%° ¿pÙ»îzz)Æ«¶ß§´Fë ¤C 6/ë¢ ðÿ à$S2Üì[7_ööñ"NÑ¡« ´« ¶Ýñ úhºeíôÒi×aÁV peù°}ÿÚ óÏ<óÏ<Æ/üóÏ<óÏ<óÎ2û¯à¿ÿ óÏ<óÏ<óÎI©Ýh¡tóÏ<óÏ<ð)Ù×,&Ì6vÿ ͼóÏ<ò7ëDj9ßþ~o¦óÏ<óÇäÌ\ÎB-!3óÏ<óÏ<æ ³JKG<óÏ<¹ä+]iPZnE¼óÏ<ðÃn¦³¥%ª¨£+|óÏ<óÏ<"¡Wu"òug¼óÏ<óÏ<æ$ü{¾Ï<óÏ<óÏ<òõÝ[Ï<óÏ<óÏ<óÏ<óÀ¾óÏ<óÏ<ÿÄ !10A Qa@ÿÚ ?ð.ÄÇù|òçc L9h¤#L`@:u Ù"NÅÆ.S÷ÄG!êÀq.ߤÚX@õð¸Ã²Láðúnc@!)o6N?/ê¯ÓÉ¿ÙNö+ÜÇ￬ àñk2CÕ®þ exH]ÛÝ#ÿ ¾Áì03 <[<° äþ]¤GF̧sîE¤ m ê 6óHORËÌ l ]OèXñ¹dûõ¶²-#9°-,rwcÌpzm8a}O{Ûâ}l°È[" Z \ énõk¾6ãñ`hÈåÔÏ9Ë®ù82÷ L9þ5SÖZïÿÄ ) !1AQað0q¡±ÁÑ áñ@ÿÚ ?ì¨é,íDÞ äYcEº#G ¼DE sú:OgTÌI¹£F{GrMGÆ:ÜRÖ nå;د O~É7ã2+hIJ:A«á2O]}ÁYG\P4Vâ¥î{!¾Á~ Ø ÐË.¿:IÞìs]ØÉåQ°àºë§Æм¸º|'¿÷÷©É8% íÁä÷Êñã58-L ×îCk_#IüÞx Î}ÛãéÚÎÖ9 ðvîÎòÔbâT¥1 Õ¨èõÇX%q5ïó3Ƚ? Ãç¯DâfA ò¸¥ôx'Uμùû8ÄiõØÝé{ ©~kí¤Aò߶¼&é³ Gj¥Ó¿o=>³.øÐSJ~ûï2è²ë÷ÕxÄ-'®½j *4àþ¹øLá¤yèìîL?5rÄXHâ8°BnôðçÄõ<#HêA þ&r*+Þ'̵°ôúö7FúÏ×Ì2l`Lä½ùubÆÅÝ/¿8À² ß Ê~å¥Î'¯â+¢\¤É0µÜ Ê£8W]tLW z HEڴ׿övHZ1PµÇG¯ W=&RnLãHSÒc¦Ý»ùAutHKi(ì ´ 8ÊJзå.·#Èí\½`Û´Q×,±¶ï êà*ñEÄq4BØÿ ÿÄ * !1AQaq@¡±Ñð 0ÁPñáÿÚ ?üc £ ûYkÜe+JqÈw6<a `^ vG-ëÿ ô¥_:L¦í¶«8®ÛÕ¼¦¸ÈsOBoX$©6(Ôx|å§C½kÃ`3 5Gÿ p ABeý8ä7Æ<½3í ÿ TÀ9\²ºP4vlÂ4mõðþóË8ûÏëÞÿ Èÿ |à «- çgt=oh]Âr=þ`ÁHÀ¼æýP!ö'©ì7eI©©§ÏÜ3¸H½÷ø¤å@èö½öLãRù>qJ46Ð]v ¨ ¨¸ zß5ÄÕ+OÛ¬¼jjÔù>·ñÔ! ÿ MÚÌZ ®, O{~¸)Dt× ë[;T hòü¹(NÂ3¯Y Iê÷íÓ¿¦R á³ 0Æ*xÁýüxp& »AËãöp1IôkëB'l\È:§&-8"áûîð³J×;>ücDlÂÜ]1¦ë6Õ¸UM?|c6¥uæ,8 -sº¯F¹ü³-Rs WÕ>r!Ä[ØÖÿ Q?¦_ì [xý?û$:í® $ÑàÃDDÐ[&ü fýJ#Èe>:Ö¦ÂJØx5Чê>#õÆ@±¬A!TþíßQ :Øò_êbùK¼&Áã¦G øQP¿Wì$møìDM8ÌEý^¼&& âèxÜþ`5ô"oÐ¯Ê iúÔð]² u¾*ë 75³W½ÆkÊQaa¯¥øyÍ=½@Eñÿ 1AFqÄÂ&ó ëÉä ¦í åAz#VÎÒµ$! W ¡>AÈäÞ)Û¯ v Ñùn5ë%ùÛá#õ<eôN2ÿ ìç¿8@EJ¼3P<ë4 0^ðùÛÎÅ"îGj®w«£ÞÚz26w®þúá7] Ãf®²_É(«K>ô ¯Æ«Q§8ù5¤ô} &7ÐHG± º TR>7Ó õI _N dÞZírxüÿ 9fón![uMÙÖÞ|}.Jó® 7M` <M°7ÄH>WìY$wèÌdh~²ßÖE¦ãÙÔÉQ±ÛÇVÙiD=Iüà*ÍqÀFrÖè¿|sþ>ó û"+=ö#ŧ8Ü88 ÄÁèoq°íÜاÌ˦HÑwç4Oa»è 5X¯ßHö#Þ Ï¨i{ýp4cGȱ ±)X'1AÂ* ¶P¹¥µ¾ÛßÏý ³&Êp§®ÍyÆU;ó¨L ALØ1äX{rà À7ß\±>åéÿ %·ü®:o6L6>áìûw»MAY§£È]Øljt ë+Ñ ¢ø0` R *øAÞõ ¾]ö:Ízʪy%Ñï·¿/ö%ª"pë £©ÕdǶ5Õ¨«i׫TÄÐEî#Å)GÒd)É^µ«|n)iHDu¤MXóc Û¸ÐÀýC zæ-Lé¾·O¼Õz>|`(uϬA;¾Giá{8yÓj$zgý¾áø-1*¨*ÖÄUMùR âcRöØóþ; Qûbó¤¢SñöK:úây ï>|óç lÐ$:lú!Zy8@|°¿hðÓß) §CÈts47 £È Ro]ç=FÆ»wþç $¬ýû`ùÐ3Èèh®ß L¬Ö h6NuÂt átî ªÅÙjV¬ßF+qãÞñ:£Gn¸+m=~µõÂ.ÓHðå¨õãðJ< K¥Fø^#\'KÜà oI %?%뫵àQÎseeTÛØ¯Þ Ô ÔÁNlì§O5Lmöùx?;÷ &Hã`ÑÊàñ{?¼ï °TS iKFÂÿ ¾]¢¬ÙÀðq/@¦ CÒüÜ>xFÇ L i*ÔUND×`-½MúCBrñ.+Âr>Ggxoðb3n%(Q*Ùà 1fÜ0ié^àmløÀæ§ýOü @C£÷ õÆÙÎRH« [`®¼{Ä>ññh ô61äãDyHk÷rS¤¤=ÅTcã#/XGë:Ð °"»UÚò \ßÁêu) 6ã7¡^'~GJ_Lò`mTí EYB1wK>°¸1À9aFÛòV%pdâ!(ìÑ6''²Q³H">ÀýsEO¤)ò:q u± ¸VC$h A¨-ý£õÈ÷Vü ýÃÀøëøúa 9 P\ò×" Âü3R¦ÅÙñqE¼ôÁ= tW3e²'ÈìÇ `°^Å|¸(pÿ G»Ùß[ 8Y(ã{,êYöî ¥ZàFª4[%! AE Æ~CFв2°§XQî : ÞQÑÙ@^JiÐüÐW\Á¥1ý¡ç¥Öw¥ Ô7ÈÄðû/HÀðº-£` D#ßá%X¸:- 1tå69&µ*ÍÌõø(êYÈ7âk/xCsiS³Á6?|nקC×Ù±ï *hç)>¸¥7ygr8ìÆ ð\÷A Óé:¸gÆ^ÓÁùN>í· >§Èd D¯ K3Ú"5yÒÑÐéq5ÙD ©×fͤkO.[/ûÀ1ÆDU×0tjÞ?_¾-%$+¥ 2ñÄpõ¯òu8Ý~N ±^öKÐnV#½ '¥Å:aè "vc8Å{:Q®0±°½§½ððíø¦þ_Ö?\ xc£Cföö£4{ÄTc(ǬBÓ_°ò ÷ë¥y<!ºy23y´$ØZ{Õ¡¢c÷\Jè©6jr 5£þÑ®§Ù,%ÓUy×˵«|M[Ûiüâ®jõ)§àßÕÄ ½éDù³Õeo³|vþs 2vT)µäª,Óéw!þ 95ìw÷G>Ì"YBE£rù5Õü )Ý·É:{BÉH)ðÒ{1_ò¨ ]ÎO¨§×u¼³|&ó]ëYNÈùÊeªSáxbð誳¡iD£ñÎô I<ø>¡ÆuÙ8û¸ .°Ì3IØ7%.F»^³$DÙi) R¨(&êÁÆÔ©Uá¨6û8»gÑäÎ%(ûñÇ(vº ¦Z]xçð I¯5¿¹xéãMÒà ½nç ³gî}Mý2#ÓÀ;ºÕà ` K FÄ{x.ªTç Hûüw[ÉõÁA,LÙIðÇñ1Ø<¯ÎT¸Ò#^¿Î*ªlr*WË-?#´æ;:¸4 8ÃfQXO O¼WÓ°¹?½L`"%`8+âßY-Ôìår>F aÎBJÝuÄÁ® èl÷þÕ¨µ þ&H¤äjº`Ûûñí`¨`y MñX-ãõÏbÿ » !¡AÀ¨aÆä\"Ò1À2tññõ9$¯IÁ ß6\J IýÆzL-¤4ë ðµ®B:gX Bð=sý÷GéV¥.Î>q¢ìÅ>áÖÓCåÖöªÖ÷ û]¯É¼@¥ÀÆA;®`U] Û Ydß!D!eàâ.¿ùGCõþk=xÎ 5rAü bòõ ÇÔ$Êä ª9kr¨çoßùÊÎOyð[Þ"X¯üï¼tc©ÕtøçÕQ¬\^XÓ°Û ³¿¶)ÊPý& ±F©ïÃüà^ÜMtʳgǨ6¯Ýûäm'gå5E<TF ÉS-àì Zðý1ëpÃúùÃ¥×ú8Á =lä¶.ÝðhØxÀÈÑ'¬}!7¬1%z®äSæ¼l+â*¼Â ¶Dqµµð8ã¶`mGef¢l"'©®NúpØÃÉámà§aåØâ¡üfò¨n´³n_çxÑL4 × è )?ÏG ¯/è}¿,\ 1dÎYBz9>R¯6çgõÄáhln pßE^Z»: N¿''yÍèó6Öâ7÷1Ã`'NÃÛôÄÕJá¾þ¿¦H ^×7çIï (6 \²ÝÒ+Á~ cB]]Ý Ó¦¢x1p*µ;aè8 måØý.ÀBñG7ÇR'Y i˽»À(G?Ö*ÃÔg,ªâõ§¼Á ©×ÆYÒ8|:ÍA¨¶Y/`¡ ¶þN 5 H¯Z0ÂT<¦ò"/ Aê;C¡Ò {ûúÁ"`5CÎirzæ öÌ£SFÏ~Æ é $'ÑÏvñÂyuña°k þ¦ ê¢ÉÓGýçÖi+i»÷ò~ÙÖí À(Àd¿oü0 3Iáðñª¡«¢;Ou¹ _F¸ºÞøÁK'-^8¯+ÿ Ièrøç¼ìPÙk>Çÿ Íä¦b l ìY_Èÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 19219 |
| Response Body - size: 19,219 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ¾¡ñ¢j4ëÝ1«j(: "N HN ZZ2íVöû·£Æ£*$ ,A£e¯Ë$«s4°óÛJno¥ËiªH*è wÇ7¼ÏÅÜÆXî}Î7©Û Å5[9ÕkyÝÍnæDèÓL¨ÚH2²r>¿>¥íݼÍv $V®á¨:¢ `NËGRªoDíS¤=}×DâÖÈ0r"HR·^ºâjå±c½ÔÆa`ï$Øm K5ÍísyÞ¿¾½ü;$ ¬´§Ø9Æ2Õ©gpâ v ×6v·?¯¹Í}ì{¹ïªúP0U§^,ÜõÞ\÷ß+qÆäXºãµÛ ÐCs#AÊ~¸ANÄfNååô¢±ÇÝ˪µ¯WÈÎ]¡Bék/*U'c«r*ëË/AQköiçÓWÒ,+jV½G|uq²¢v`g÷äÏça\Ê¿èTw¼¢$U²Ñ`ïTÀÎoHçÓz WÃfÛ·J7þcMغri H"¶tcãå Ñ×Hj]=òó7qi¥«Òù_EæÓö5 e6?©cmpXP·wÑ,ôq£Ï è_Z·sù¼ ´xÒE¥2wÛ9º úôtdëzÎÅ4«öD' lèÐål´PK1æ¨ ]l³Üù¦zÎe"äì<߯½ü¯cFÛ :VÖøg×>[ú4 nã´ÍWô:8Üí,të·UÑÏy×X¶ÉÊÄzF³¯kIÑ£yfS¹6ÊJN¥[F§oO/I1«Võji¹è\GmçØZÌØâ ÒÄR{Ï ¶ØB*¤S3B ºÎjÿ qB÷Ë®êfj2OnXe 4í$ÕÖ |ic¶8åoF¤Í ±WX` ȼô±*9jÖ¡íy/\þÓêà Þm£wô*º%κjuoæ}Íîc§@ãImq o'C9À6g[nÚ¾dc{TÅЪ¹µ]Lm9qõÞbÙ[ ^vÛhXÏi X;Úi.` -R¹G ÷¹GÁRsû¯?ìÂÛZ&UË´8ÍÌcñ¯-HÞ-Ò V×;Wcç[rÜ_¡pûÒK0_z¢ÔÕ¦-}+¾ùJƶq4 ;?B¨¦¬ØÓ.µ$\P£®±£BSÂl2VÀ½Ìk©cë>QèjÉ[ïçÇïF¶µåÌîXªmbôÖ3ï3Ôù8jÇÏEÖ'T´ô ÖiÈ`7 BÆ6µ>Mò°â°> é^kËè6ѳᤫYÚý Ïï0à궻Q-C¡nH_Ç]÷Ï=)mÈí®bÛ h<ÙÒÇhVÍLÐøt ü Ü U }´l@¶qÔ §t?¹Ð'r|X1´è ]|² p3ºð ú{ D2¿=ÄyåÊÂÿÄ * !0 "1#$2@CPÿÚ ü.ê¿ùëãÃw~@[PZ7vï÷áÜmZ[ZYYWÛq>7bi_ATßÕs-Ê%ZüçÝÑUnØünÑC«°,oãsZ·U¯ºå¥ }¤UQ¬ù-shD~ï¨ÛC /ãs´ßãq¢4=t¬RaJû®ãíƯ údÙ½~güu@6¯"®{:¹¿Ç$ÿ Oíc`¯½ð²µåãtQÑææᶪæý.ÈëØ9æÛ Ö ²» Âêf×î.¥OsPT [F#Î÷ôäÔ$/ãÆ ÎõPÝÖü _²Ù¸Më(·.á G TÀ: ÎOåÉ~´AÔöë«hP°Jº-Õ72/¾F2 CôÜeV;ù,¶±Jc÷÷»¾ÎQZ_µVS¹ §¦Æóò¸êGF´ò¨ ØWÊ/®êXÂHÝt]hrrâÈËãÉw²<2)½áÜahxFU 1ü¥Õ×æƱìÅ̼Kð3Bq?õû.\hQQmu.7?òl/nBkunÀNÀ´ ggXÿ Fÿ ;5 ¨×]óÀC;¥\kèÝ o¯Ñrý. eÕ³ ئâYò<gºg( þÞêw(V'$h÷pÓ V AòV÷.á\it;ÊdÒò Zê6ZÐCâ¿+ô¿K ãvÆÆã8ñßÇg·± Å`¨Qþ&ê:¼Æÿ TÊ3¤z¸ª f ûF^ÄÜÛ6³öã1®åÄE`Æ2ÛK^/Ä_Múñ¿! lèüWUañ˸¼ÜF}Q-ðÙFóu ðð°lßΪæý·Z*1eåâ4?# ÇM³jÌc(_mjî ¯ªåÆÆ©£Z¹¨¯*òhbïÆÂþàd+b´Ø]vw·³¿KUq OÝËdØñy&ì|± òd*Öò[ò¼M!(*ôÜÜÜíøoÒåË.£tkÜë |vãq18am£!ÌGÅ¢ô¸pÆ£>'kbr ª»TPÐÕzoÔ®-¶· ÕÍþ7.(P¥Ïç@Ì6qêN&Md=|rµÙ®2ñ¦ÎËspÙ«ï¸Ã¦8o?nm=?&²)£v+ð"Õ @õ_î¼[¯MÍú_¥Â.Ë: rÊú¬\QYr¥íä¢ø¢s+ælàâ9ÜÐÀ§ r~é ÀÇY1abÆöÆ¢øÂeÓòyËJ¹¹¹¹¹¹¸W< cßp®Y N¹Ç!êÄ`²®©¦Ó,ÙþtÚ³´í 0j/0ñYÁ5Íkk<Í,H_°Ô^ù^]£æ ʹ¹¸ÒýDî¯sp¦=wuyÉMð3i7#É´.AÝ»8 ¬ LMÙ@²»6PÎc òo§y¼¦-Vp V±ø\9úÓ}([[¶ÐÐëq¿Æ³³¼ÕCÛrî ôݧ;!FlA6 ÂË#|¥B4æ_ëkäÐ}³±}ªðnwý·Á õÁÌGc4ãk1]£È¿íJr¯Öî\`ÑKXy±-m- ]Ê?¬[-×iw *«Ê^Awø¾'(ʲ²O®&u ÷"Ì 33 XüxO(T3ÿ BúYpøñräZ²d*æçiGóëráÁÉjesøìp2få~æfä3 ¯ä1ëôSwrîXyÅâ0 4µß·N?ºgüÎe?'²V.e¹jÑ @¢áÇCí°²!¸»ÝÕÍÍPãõESsrå¸"Ò. Ìò¥,ËÊw{s\7ujȧës:ïÒæN1ë Nªÿ ^i933*Ünwxw¾8üP~fy§?Îì%Ë]îGÄ¥ãb`[ró«P âPÖå|ÜÜÜ»DÂòn°ñ]ËɬXÕùPî2ÆÆøR¿6^H¬2ÈÝÁ+âX.ãEy9*,á¬Ó t ä±Øöåcx©UUOÿÄ + !1" A02QBqÁñÿÚ ?¹s(_ú/érþ£³S.ÆŨÈWÏìȵbo`LUóö=0dsÄz /Ý}=̺Çù ú_}ÏJT6È;s6Goûñ 'å=/ÚºO3{Vù åJ1ôft;|JSô»üN?_MÊûuæfÕÉÈüaBÀ.W£ö éì0lg¨`£paf4&¾oMåÆ YjÀÆC 3g ãø¨»,fnjõ55\?!3räyùûQ¨ÄßR¼2¦ Ц¸Å\ ìy¤#!iXãj3]®CÄ°E´¬|ýî¨~Bæ®×º8¼ÛÈØW¡Bç©cß`cb¦ÄÔfg¸Ç¸ÚÀÜÇQÉ2?D[3>¯²@úÇ/3K^¸ÍÜMdÀÚj[ó3æ|¿Ìý¢ká9MLÇüüCµuQ2|. &` ¹Â±z°^âøW§ BìC7°Ù¶n¦E£*T©PD5?U »ðãÅb½õ1õæPêRsiÆ&6æº7ÇBl¹3??òTÇ ÄÚÔãd2¥A,@f*±%õ?°fÆ·% ±QqàÂb \Db îläöÇBfØg^&*zv?ºÜcá8Í«=P2ÌXY!@@¨O7s5þ#kün¦,Có0 ©þf|àÆÕËí5Á®¹ûeÔ( ÌjQ® q±ó YÙz Jó¹K±k Ö¡"ª{?Çêd¶±uæl\¥EYt'¶ äg³Os ª¯S:ÛOjùx¬$(îsùBHz Ï Ìñö Ì£õ*fcU ¹SUC5©ù©ü4 âÿ ßýL±¾æ^§ÿÄ 1 !1 "Að2¡0Qq#a±ÁÑñÿÚ ?ìÝæÛú5Ø C@Aý+q¤µ®@Çô5ûUrûGÊñà=8h|ãÃñÀmsÁT<£ÆÙñ.óf[éüÍ3«/qànD¤(müs;ñÆ=f{uµ±Ç¤KÓ¸g ±;å(ÐÞl Ä.-³jäNðct̷̸馸!éé4öóà¾é¶iun5¼ÔÞ0bc _ £!ûÊÎ ¿G¼}F7Í Ê·#óµ @ UÂÅÜ%õ°ÎÃÍmÚç¥(Ájèf«HïN14-Ä^íÉ E°7O F Ô q^ó*%ÎÜmÆfË u¬r{IUÂÑm¾OI®pWvéðÇDMÂ%é«;z]I_Ò<VÙ°f[xuþäÄÑ`Üæ_¥ÍÀt·VÅenúbWøÌ:öªcPËËþa·Wõ,6¾;¦÷ïíIfÓ´ñ47¾Uæ)ñ4õ©È Û5` Íc ð2eM½¿oÏù1Ú¿y\t:*õ ·f¥¬bW·ÒÆp%îPzx 1¸1>S5:]°ncm ùûM6¯k8ù ËQ·nS5fÕnôµ±+ÔMfß1o´® Fܽ÷Åg¤MÌ&%ÆåÁyU¥Öþ²C+²Øf¯vyäF^ïnà >GÝnäÅÔùöæZçÒk/ry@p¿Lªµê º»ÕÛ,Ô>7%zì@ôæ1ò¸¬ý °ejç$MF¼o/úDn _còG÷ ½}ÿ 0é =ÿ Ü èûg ÿ ò.¸ )Nõ÷ïß¿Þ ©jÒ¾²«7®faFx55-ÜpfµígÆfá99ò\¬²á§¨ å ÄªÔ Ùûû1é&¬ ° S0PþÓûO¬ØÜEþ ¢ôGïlbÞ2-ëÍ[¨²úMe¬µfiýæb²Á¹ÿ ãóQ5CÈL¼#øÿ sHæÛ¶·¨;6ÉIÝÖÿÄ : !1"AQa 02q#¡ðBR±Á@rÑáñ3b$4PÿÚ ?îgÿ ëü± Ü9ÿ !¾`°¶ð¼A(t[6úåfûNÞº8+"<rKAVQp§/3¤«ñüüǧ0Fº *#yÖó?]#ùvÂcí÷,2éåÅXǶ9µ ÓÀ![x/Üx2Dg ï|½¦ `ê¯=FOª§hUg=µS duãôQøxx&ÝU{ Îë]¡û?^¾åôÂ%¢×îN3 ¢ÀZzøäΤ ã2:î;:ürF>¿ºc ölîØ7LdXÛgbV§ ðë83ßph¹ÜÚÿ vâòÞþ¢ËK}c/ºé3û.ùT·NãG3 æÜÙ pÙ{*ù5À~?E³°RÉÝ º¸yf5âëÞwâ¿Ðj*ÝwËLÂP' 'i>ëd'Z÷JmRØâ¡ûÌkþÔ¢Ê ÜùÂ=0¸÷2ù~±0Þ^1Ð Àò÷7SË Ï!PÕÌóçöMÉ -Õ 3ØÖ Êb0·|<£h ÃT6Ö7-áõXǯU6´W¼µÀÛ¿lÊ5(Ú]ºiçÉV©RÁ³Þß;¾ÛC¦8ýxê±ks¯ß>×κ´ýýá L@^NJ Û2°÷þ¢sA9#4hìäg<|âV9Ôj7%墻¢##$¨q®ÍÃ0wÇ1âÁì<6Ó{[Ã@ìôûÕÕ¦+RÌSkU?á©»!ÆO *±m;«ÜÐ1)®$Hok ôU¦¥B&÷ÕS}£8'6« 8Z±§àZ'S\Àn÷ ãÕMÒw´}B.×â¶ÞÐò×4\Ú|_ÑS¡¾fòÉáÏD1 9(v$i"Usí/$Í2*bÚntV:ãXê=U9\.2{ }íaë¢eJmptúª´j=Ì:OÁ$uð¹ .·þÅ2HFpGtì:O)RÙ3'_Íxth }P}7Ò ßºg]U:t8cDj±íHTÍP÷Õk-§¿Úz({EìqÆ?Òx£L[¤Ýõì.c ZÀw$è¢{KmTÁ¬ËðD3¦h{vÏr¨ó+ÏJw`àã¶LrñìoÏ¢-ö}÷?ÌíAôÞæÙ?t¸\5ZÇ#!°»{¤KOÍRo¼==ëU.Æîºÿ nÊ Ú%²3ǹ¼D&ºñ$ #°D6ìº[y~«hÀE¹ÔÚÖâ]® ¶Q°ó \ê¾ÚP 5 ¿U _{væSJ`T8x8Þ 0·xàölhCoÖ5+kE̵°ÙcÕIt¥=¯uØ»° îH²Î¡æ9OÍnd N»tsÓ¹ö $ Â-ÿõSB¥7ùµÿ Aî¼3£Q÷ú*Û>ß3%§yløLªsKörw±õ ïö'7Ú+]Ã:'Ôtß? Æ©»çt!q.}¬{XíÒåúöØ èRÛ÷Q Ó àâây¼ҵÜÓÉ´¸âÓÝʪ:ÍM:ü¿T0좶³ýéòܶÅÎyÑÃ%¥ìÏ e>£% ÉcôTöu)Ó:<ê9 qRÂtà2·Ìäa $Ï´NpÚ:ñÇDú;XQ1(¹Õ=ÿ D Õ6«ÉÃV¿õM§\[v¼¥lö6È ¨Ã`.}¡ó -|QuÑÿ ]T¼ÿ ãÏü£"ô÷LDáÐu_ûFÆ*@wÅH$pRpÞóîüb8fZòbõ ÝÞØçÃã趮¨ëGáhm¹ß ÇdHïºDÂuzÛ´F ¿OÆ © 5²mä¬è ÞýUùêîvàÊpi qåàxjÖ`nkhÖ Âp8½®ÍÛ[wµ ÒÚXAÌˬÀHÎRe[êió⦤ÖCÌü¹)3¦æ±.Ü> TmSå6·ÓónæÏhi0u mZ.¹üGÜ¢$:(g¬ÆfZ2YS}Íäc+òõäe¯.Çt÷FØ.ø&3ÈGrÅï4fìôN/¹×béÑ ó*lªóc ôMö¡å©Ãy ðï [fª c 2³éÊkè{¦w6˧öãÁlÜÇ 24Ò3$ykLÁÈÆ«dlk@Ъ+X qSl¦ÊµÌlãEL ÎØ5 Nó©º A¬Qu ®ØZ^Áu§"e²-'ª}IÂæ»GZuùGZì6 µÏåþ4PüªÕIí:|B©Q²iÌóTö hB$º_ùÿ ÍS÷Îóʤʣx¶A-á÷)ΧçäÚh$ñM± z'C`©NkHoÁ7½SX*4æ9&lMÃ%Î 8D Öá1æÜ7xö[¨ÔOÏtÐûaÏn0kxÚàÞ ¾ÑRô5ë¢÷ta Ù3× àt¸j²ÌCZmpý¾©îÖÓç|4BTÆ?ç¨_ÄÕ4 Á¹!ËX ÏsÞÒsú¹ÙÌ«º \Zà?äåþ>H8¹» @Ô¢Ò 7 "ÓæiÝ(2Ð<õV¼gΫF¨Þ ªQ£AÆóù ºèíKG4Ê©¾5# 4Ï~ÆÄcªÙ¸ËGôqïÓÜCë£ÚÚpdÀþ^¥O+i7#Áj2y Û^ÀDÜ[Ð}¬DGßúVµ oq=;0'µ¬Ù1%KÚßépÊ-"3¢ àúx¿/dá>ÖÓ/Éûê³- ÍçSþ&ç541 ¦myð4BCf7ã#æª2Ïví øpûÑC[å7 þ\Â$ "ÚNàS:ÑÖ; gµÅ¢mê:YJ«qaÕÇpÜÞ}ÿ sIÏ?ÑwÞ¨ ¯u @ Ñ@T.uÎR«)0F9rìWNû=óð-'Oì®ã~]Ýß $F§öçØö¼eÞSÈÊkZt<Ó`Eã «:ýåSÖé$e]§ªb,ëQÛ±Ë=4T¨û5+0^x©eGT`?1Ñ n$Ô3÷Õ=u73_kç L yõp2£ØÁ¹ÎѪêθöÆo¼Á/CÍoeLgºXþHøËèþ ÝTÅw<qj© ËÓ2^N¿sC't¢ D4È í²Ýâ¥ÇúöKL±}&þ1?Ùp¸+]]òÂ,tÂk;1¬è7äpÞ?D ÏÿÄ ) ! 1AQaq¡ð ±ÁÑá0ñ@ÿÚ ?!ýJWÿ À±ú§þ+ú !$IãªßÍý?÷g% ýÌbBIB#vÊà¨p×ûì`þ¹ôUÇôØÅ´»ßý~ø:¶Â2w®WÇáÿ WÐÒcÙ ¤9 ޣˬ¤,F¿ÝoX§'ôO¨2Àääú¬þ Tâ 2-'ÈK&sÌÍÎBÿ g\Xp`s& !£nökyk~⥲O |¦ qX?®KRMÈç4C;ú¾¦NõqcôO"\cdöb ]®R×Î@¨!îsÇÓ56ÁQ_õq P]a+Bt<½ uÖ|[Ô/Î@ÎÊ:×ô}1V999>Ä+;`&j|*+8÷äf$¿P+¸ö¶÷Æ2ÏCÝÏOa2HÓÐÑË>äXĽl,3³ Q rÈ£ !dÚÙíh | $ÉÉÇYh`¿ißO>Äj21CDÚ-PMÆ,=ÑɨÚKúDÿ <û¿C"s$ P6{íO,ù>H£x|=}7Éá!ÜuW8tô8P¶_W}d¾ ïðÎD?eO¹ûb$«åX{'N.iÒðà09 EÚþíÁ¡ÃxÁ¦a@ 5¿ãM&*|üa ,nQ # `%ýqI,ë':L[xÊÈ}zràãwÅÜmý°Ð)Xú 8¡ûå*]{Yñ.ÁÆ Ý-Á9'7 ¡H×M óÿ ¸Dv~!¥àýðp+o'] q;5VÑcH¢'l ã~Bº$r¶å ¡Ç ã# 1°Ô ªÒu>s&(ZMILVÂ¥S×¾kEÚ·Ùã#gv¸zO¤ú¸ë)Ò2K4§ w'¹. ~Gì0½§No¢ÌØé0¾Q8I êê(ær½Ü4hI ¾øÁF@+q#öɾ[mÉóíQ4CQ ,8£8³¹)5ÈöiÂàÔËÖôÍy òQ'h19 Ê ¼@ßõ #-{!Ç_à?¡Ç ç ÜK]vÜUQ×ð C)Ûmßq8VRoçóíz+(ÜöÄNËÃZ²¾?פÄ7Ä#< 0±DºÏe§ô¼*·µp¯El<u;Âölà"7ô®å8$ ÷ ÁqËÙq°\vÇÍOÂG"}Y»áÙñK§ÓËs¨q¹¼·ÞDÅ Éôÿ %2YRý?K(PNrС|ÁÆ[¹ÑkunSTh¡÷DsI@ WFvdõI¦ ¶Þ3áë'''''Õôwð`Ál³-HÄbA)¾rgCNËu¨ ºxxë ³`ó¼¤ lFýÄøÖNÞCðNKVf¥Ñmd .gÇ/ û´×ÆB@± ü¼Ïé''Òcøe}îÚ²üå\ó1ÛQrÿ u?é¯%(KÖ F(JÜK^ ÂÐ øic¬× 9Mà^¦"xb!4 $øó£ÚÆfÓJuægÄ`)«ÝfòÑ]ù2·¾ø U¬¹Q$ûßÑÀÔtBsq"K¸-måç$QßOéÆfÀ7/ ùߤúM Á8(]ú*pf Û5çÏïã 2I9(?5#2¡'Ó³ÛPáÙäåyÁ$ÞJ©IHE¶Y5ö?r¦ûÑ E`ëÒrrKOM1G¦ PíI\çãqñ-Ln,ª¯¬îì(Ýç§ör&JV.gý÷[\vÍl§Å¯8Bª ηõÃ]µ¹0&FpG¿ìÇ!ËÛ©K ÈÄès»GíÖNNN&ªðÂaJ¸¹ºñÉ]áöÁ@} d2;©¸é 8Ù EíßX(DÜW:M?t_÷ ]í]OJ{ p©7cE]Ö¾3iúWÕc¬qÄZ¸cÄÏà\ ×> }ñMߥî?°}²@¤9,üý² FZ4Ûܾ+¬Ù¦®0X½503@ò·?ù6´òR¶>ºûä9¡TÓÜÎdItfBã(BÏ¿{rsиQ 0 ݧ¸ß¨©\@@`8¥rs|s ñppÚm× ¸ Z ù«'x»ÔÓ|óªY<ýqAä<è>´s #VÓÒ>xÈEPñ0HXgGµbÖ/YÉõ_EéH Nq&3¯$°ñÍ)âzñxÂ"äBç&<I{òà0r)ääË@f .¶þìÏüdKS$]ßËÇH''Çäb²¯g½Ä÷Äk¡g @rex KØòÀºu0ªäÿ 6ºÚ[ ÍorëßÙÊS7Ö%ß».O¾þù4öâá©üÖ Hi,B`¼Z?yâãxóbÔqnCÓÓHÁÆAíòLè 1sü¸F D Ð01Gbqãüǧ5£ãó47%àÉ¥ ij1&þ"2¢¦59nqqå¥áta&&¯ qU%A½i¨-úd Ë?À_Ê(¬4Cqro;Øã®ÃÆ2fú`q°ô)èø2±D,d²}ôß5Í3O@Þk&Ø%x3]6G<·SoSÎ2×°^ÑκÅ8 8ì§ØRs÷ÔoyDkÏ?lè¿ /£zrtx<2æªÏßøÄ2!Ð èøû̹va§Ùóç$ r":EÅ}'â²"5¹(3¨2 Ü{Í`Kcx f3ë6G8Ço ¼á©^£R(|VMFDÙ»Ö^¢Î(÷ô~.+ÍÍ&9Ý Úª·ë \{~?muIÁÁÎûÇÇë¹ëµñßv ¢_Û>¾ç9_¢nQ{8@,¢ªwßOÆAX«qQól ÕM?\nÌ_:æzþt -W÷.KvK}Á'«!ímAæp ËQäùq 4&ÏÎ?I}*ÆP7XO¿ ¼R \hõ0Çã 0ȼ` @±1¶ãë^S¼8ñcÍý{©h=8(P §ÃÉP8<°ÁÖÀ7¸ãëXÐ0lK ` Üÿ 9Kɨ`Ä,*¢KX7 {8âtÂN½A4íPú reÂN\ůd^7±H ¿Ó **3øáHS_äè$S I=²II·õºàÆK Ù1°äë RÚ=ÉMü1Õ JÎÿ =bôȵÞmf ~çr|9~q*É ÓB&L)ÔൠMÕdú$ìõ߶ ¤Òûc& ÈKs~\VttÅÄñÖóð$ ¯Ä]b»øT=ò)µÁ;Ö6O$q Áã_CtL}øÍ9 OÔ ¯-¾,*Ö FØ®Û}òh$@ûë)SYÇÖ~¹4OH}Èt@z\80à&)ÇN8¼¾uî´Í Laõ$#íÎL299Ç-bJ\UÛMª¶V¤wÞñ´ÉUéJlRG '8?{U|>Ùp³ùÀ¼ÃgØÄdJPcoûÖR"÷¹Åæûgqªq|´\>0U'aÆÞ9-Û'ôÄD æÛðòã@Ðv7 ²Màݶoóò¯àOx2 Ã+ý§ù^|b½µÖ~?ßlµgØpÑ|ÖJhÙ&È÷?ÑÂ0 yf¸ë$÷ÎÏ^×5ç DWÆ!Ï p5íò©ÉE=ß)³ÚxÁÐåX ¦$ÄæzÈá[r½U»ÍôS Ûõd&mO³æ~5s$µÙ.ñåvQ,xbj!åöÛ¤äfzUÙ¹4÷);ç;kÈÂa*|¾Às 5ÒPÑÖ%¡$Ø×F·IÆwFh|t{¹ Ç{·ôÄdOÂ|aSQu_¹:Ö!Õîo ¯ îç÷ OHÌrË`õêç7ÈTr 1¢! lxn@z {{9ÎJcËl/jGñ6v³ Шykç7(íÉàR'-ðª;l~%Ï 2ädY/8³¸4`=ðÃÀóu ¬\ì:ºâðiËÜu¾p+i;ñXÌü"! ½±â/´æw! ùÎ,¨bâ>l,Fìd»EW¹§nÖ'QóçÇ/$X\§ Pò÷õËÒ /× ÄT,¾Ï4ôm6Þ(äÀÒdiUîc) ÿ !rX§cô§v(<ÔG©Qu0]G¼± åF)YüXÐhD v×͹ï××êJþó`«'Ù;KÖH¥(uÛíJÐ]Sq{:sÎ ¬cH_ÒqQ#¬ò#ÉøelêÝüápRØB.§,»ìêâïa>Iþre6®sÛƽ³3U¹ùÞ*M¾ ~ÙÜâ"<¨wç! )ÄSÇõXlè*+ãX Ä@©.8z×0¨µE½ 2ÿ F©é·Iîc)+l éQ¼3 {VgãsîÆ¡+*J¸<<Er Eµ~ÿ ;& JeÅóá¬,"u&§ÌÎHË×(Rý¿b³Ê´9ãZ¯0Kf@ # û;ë/õÔ `¿ÅÓ¹ïÑ/]3ÝÀ ûþX'äaø~qeòpj¡9¤£Ç¶"á¥. oQ>ÛÀAJÍ8XÆpø'yH§'3ÿÚ É ë=¯ú?wÿ ÿ ÍÅûïÿ ÿ 2ÿ Ïþèýïã Óp¢rÀ£Ö<Òþr+ªÙÓ£ø$Á$¾½ðAíkQb Ìü:Ù*+×ßÚ®ðZt»º¤Z'9þÀ¨³UmwâQÄ4L¢Oúyp5ͲsKó_Yßo<»WÞ| :BF\þ,}+Hg=ÎZ¢öl5?ÜtP¿¥{ÍBìSɯh â8þýп~(öò/ÜÿÄ ' !1AQaqð¡±ÁÑñ áÿÚ ?i 4@ùé^ÒY)âZ¼NgÓ¯Hî.\¿ ¶²¬{ÌɾÓÎø_nê>8\(U pÛL{ÜIR D+AÒaà-ÀK©Êááztáëùã ýó.\¿7G `7 \¦:ñ;é7prÛ|(j\¸7¢¯sZ l@öé}eȱ Ûyúë ª uë-DTÍÉà` èo^oÊ [W= %IÌ-oͬ{Án4¨S \j¨k¿hÀY5u̸ÆC¬¼¯^¼¯hu m߯Ä((ë³ïrÆ·ëþÝÜ+çëç[qõãÏð8éZc<¹Lߨäã[p©¿]¾ù,Ç&Ý÷ôÍÒ_xQ^Þ*ç¯ßÆÒ2ÀW³ß9^àpBRL¸_6 kÁËßÖt#¾øGXk-o}+5þ&<J"\n(¬G¦¢ôå¤GÞ;ö÷Ô.¼âDA($:¡.F4±¥è9ï×¼Ê6V» `õçÄ!:Ýs¯ºøbÔ©VAMíûçå(׻㱮x_~¹&¼_®ñ±¬Ñ6sÐë¹o È@Þ36I%âæ eÑ¿ÜÊ¡W^_ õêô8ÿ Ía"&¯®1tïµKp1 Wä9ðdEF dö¾÷é;ø ¤u2LZbIn®:c]¯Ki¼' Ê{@ÜmZé¯íCß{ôGEÀ翬Ï/£wëÞ+Õù·àSä¥`ÎûÌÚk {ü3ÞÑ@µòîúKEÄªÚ ,]IÊéÿ aª_}±*ÞÁÒ-²¢ Ëpâa+1iM [ñ¦<ê"Ãô|:úó&¡å¯}ó²Cê 'ïRÈù?+»«¾ÿ ]2yµ¡Ý@ÄÛ·¿}eÙ ÎÒþ Ö 5 1en ÁP jÅ d ïïÝy2´+ó©§ µÑ¤¤ E[LüG\Öd¸ùFýe.ÖÊA¥¯F À¿Ù kóö عâ%|ÌÖÆ,CÌçÁÿ ¾ÿ ²¥\Ö ³ÿÄ ( ! 1AQaq¡ ±ÁÑðáñ0ÿÚ ?m ûÿ D8©áßÜç C¥|A ¦cßlè ïßEtÈúQàëW±ºóç¾æ ÈÚ½j®ýÞµàÑ;c£ >y8¾¢ 80µ1ü½5dÈ,L 1H2ä#E;п ð¬ï÷õÁÉÉÀÁ1Vf8Y%:i]GLz£úî[ÀÁ*ïÝbtâ7®ø$Å â .<Õf ã®øîN! y¼út®ød¨öøÿ 0[«s°(rX7 K=«& 3EM{äx$âá]úuiã"I®30tt9Ú~2¿ßIpfÉ<öô#¡=qYfnµ¨Ô]»««¹H¸µô/qXÐ=& ¾zõÙæ°Gy<GÇK¼à§PÉ W¤Ø»? ¼Õ Vfôòó ãË Æ7Å»¿JÂéÆÑÌ}&q£ 1ÇNÕ«D`ªÔ§XêÕå MÈby§¤ÎAk'O×÷³b^;ÓK57£]\7QÞ²q¢p8SÚ³¶+zuítÄ s®' Aòtí>W4K ÁMî&«¤ó¸Áú Âù öÈÈ::ßùx}î/>½±á@êÙ:iZ7[8 ²Ôíò®Ç è@2 x9¾W)ô²½j¼1c|ÆþÐóSß- +ªòzÄöï8è300s'úì Of?º]d"1²"µ´'_ Âr| ãåÖKG-V$æà&Á-×N4§¾NLTäû'ιÝ+ï¯OOVVd£ óûÎ$)¢zÅvfßr°Ä¬ßÌ3Ïç;ûà \½ñoæ<Ïc¬ääâø ÈNHù ¾æH$4ÍûÓØy`Ú£Òå Í6Ê\ÓÀ éæ>1£¦b:þL (ÑdQØë}¤QK)éÇ %ÞA×Hiîå§Ê'ÛÛ\àø4 ^zåY£DaIÁé#b «8®~ËFXzó §)@L]ÄÍÖïú±+ ÕÌ?<ãÖi7+ cÁ ÂÛÕIMîcú0 >ïô~p`ëÉI8²ý=>w$Ô-#|Ô×¾#OlX8¸lýðú{`^¨qùøónäÎ!ø8¸5"L½ üþ£(G#pÑ Q|K¸Þ, ÊðIg£X>áWÌsCÓÚÂ"ª¥ °eÈÿ O#SÁ,¢µô¤Ä9ýDõax«v~zÔÇ粯°DX÷ô Á× çaOÊÈ]ND-F¢ý4möM¤jgüÁq@µa~ã¾8Å2G\Eýýøä®õ³ÜÈ÷H) h[êfñF´x m Ø#O;ߧ£¡y+a¼ÚÊÍþ£ ¦ýg@Ç÷_îq àíoùìd£'RßN>Ð öÇf={áJ.*·×¯8°d{Ïèòâ°$Ô"« ê¦0A £f ¬¡eÞ¦ü²IR¬æ}5X 4/÷Î8{ÿÄ ' !1AQaq ¡0±ÑÁáðÿÚ ?ü_ÅIJ`~Õï Ëþ Ü4 ûùþÇáùY µü[GðXÆ° 7¿Öh°âti`@ØíÃr¹råËþKqæ#&; ûÌC§>É hiYîH ×þ9¹7{@7M µOPiüØŸý~~ P_Ë¢½pT1ÝÅ53Äùë¸q©F®Ð ûàØù øþ:ÃháT¦ Þ|þñUbg VÒz²`Ä*Îj¾(:EG0ùeüS¸³¹¼´gy#÷÷ÄÅ^¿5ÏÊÜX.¸ ³dé X¨')WGX©SYTaÌÿ § 4§².ß91"on"]ÁX£4Øá £S@ôA¨6BÚ«Qvû<Ïø¬î-pDv+Øä±Bà(- ¸ xLè` ÷ãð· `)$Ð +:¾ï¨cFÀ¬ v ì·fCñ èêê¤JÊ( ½ à@çµê¸?åËø.-bãW¸½ÃPlNY\©sÙÃÎl+Ô¢L(àÆõYF> 'OT¸#óó÷5C¯àJ- ïD¯¼hý°Di ݱT >° _ïÊe<IõËù\V"= *D°VDoxle×jÝÌ´ÁHátßY }7\ÿ ~ñÏÅÿ ~? ó/RüÄ;q /ÑÁàNi9´îAêB4Ý$¿ ¡Õc & ¥ KÏ5Sév}Ø[Ícl ?£c-ÊD ð @P½l©2 ¡×@RUÍõÔÒS¨ ;«xÀS¿ÙMëûü/ã{ÔYX/ÕÁL¢]ù& m éÙ_ùø ,§ÎSçï.\¹* ¬SÃRÙ éZ k z>Õ l ~\nà=Âõý`=0C_ï4P P R7×ÿ ¼Dsôõo,' ¹Ì¾(GE .Øw}C F*«]qm,DÝÚÔPxá Zîu!ùÅYÃT_UåJ¢QhÞµEÁ ) 6b¨¦º:dpæ~¢¾ol1 «jlÏÓ5r¿¢ûÍôªÔºz]|O>_Åf-|( d{ RÇúTKÎ " Í¡Õ**bÒÝYý?éÉ´ z ª@ ¬à×ZÃT Þà.I jº*´ ID\Ø£¥ ýa6Ô=GÀU| ÁÑÍ{Mxc,ûñS*o×x4ÙkÒÜFËÓÀJ6éZjÛUÅ#è´@l¢}þVçÆ>Ñ\³ ¡ÿ ç{2PØM÷Ì*·erÒlJ¨íÔµÝ'Ïôäàt¥¡x[EÔalÇÒ_ÈWçÁ §Î#þ³¦\PÞÿ ÍÆ# @[ [fï°P*¨o"&FKµÒÛM »ÍúÕBé! ,¬=JSd%Ò°²Á! TòFÈŧ 7°¼RAFMhÀtOéÃÖPãvN ¢ÂE du k(¶,EHâpây}ÝÀdâÇáºÄ õù` ßrâßÃó8ì~Å1©ðMÿ GÆUÌY1} `pcyÆÜØ úTïZHB6»0qm@T ªúÕwAv<ÅL>_Åf-üÄà#îR?Y,Q«´w+¸ÑSÌ jÛ×ʺ4E^P:1C3ÅKbèÚÔwûXT$`*á±,dà¬IG!Ð]: ¡¥)Þ#3ÿ 0JYEoh¼nvp ª©°·ÖSzl=²VÛ* n¦ZÈ e Nã/\©èx¡c<¯íü¬ü-ãÔÄEÏÒÂJ$!vtM ¨då:6È(H *ÖRÂV½I©ÙbÃeÔ¥ÆFô§BKWȹH;¨Þ_£5þ3ïÞ <>~úb¿/ÏÇOÞôÉ:4á 9î%Í õ>å/Áê @@ C#TE,n C»Á%Â|QPW"`O³L¨CèR)R¯U+ ÁH RzÃ9ì$V a\ªÉóì!TRÀ,}5U½"SÍÅè:vORЦB! Q½öïþòå~Ãg£ Þ ½Ä%®Þ°¨!B¦ÕFéf/G!»>¬TBl¼-~LÕ>L P ôÑX¿1DP `Y°lÉ1c@_P¬ýW)üÅ®:?×Æ ó§ëÞAMæÏ aÒé³GD°m <>ÁÑ(¦Î¤6¿ Ü% `J© 7KÑùÅåiT7M iëÏYªD3nö'jqù#F4&ºQCHµM3ÐïPºøìß¡¤ºËGUÀTpPã¶ÀÅ®V/Ë|6 ?Fßë C¬þÏóõ\0¬& G5ÑPV* P4t¢ÿ ¤Ìy@ jÒºÀÃg¬ D-=Ì 2ªÍÐvÞåzÕò( 8ÆA*Ö®°EVå @±zw ; UM6×ð#ï'ï *÷ð¼üuü(ðDpoÞ° ©aWÀä]¥VÖêbUWF 6&DID X µðÈ q¥Sýâw ï[=!F%m¸ÎX`´SÇtÈ Ý C¬4 öf»»Þ$± ýGÀÍf þ± .Ï'÷½|ÇQ%(°S°+X'n¾ñ0ûj z ðFî÷eUÒllQé=7¤ÔÈ"0ÙüksË4èuF£g£º4izÞû k]è !âøF4G EÇoÞC¼Á¼þç4aà x ôÄu``W°ôÆâ`ì,DlôI!Ö0D2ÐÚB B;V -ãÄêe9®¢V ®Q>·uÆÔipd#EbtÀF4DÞù» MÒIõ ÁéEÒUÖ×´*´ áEH衱j¢:Å)ânÇSç µ }Ô:;; =ñÏÓ7Ìn.QC6¢I6iã9À£f¨Átu1 Eä.É) ¬ÁnÅE MÒ ¦!lm³é(>Âq5®¶]uhé #¡Ht4Q08T¢Ñôh rýf@ÂlÛ±mî=? Ð}Ãjó ïàg0yX«×ðÜWFÅyà h ¾W D`pNÄm'ÌDIðUùP+LoOÔ wXC¶úf¤®»;ÒÀ÷é¬%?øCFÄ>¼TòªÈò%÷b5ås[P¦Äßµ0 ÂZjøÄÆ ?°©h n¸M`½1~[G pÑKßûÇrfÚkëX«Ô*Db(8dø Ü)zpæ÷HàV¡ÑÅl>µ+ëè´Öi¬ ?¢gcöÀfªJøRê4Mäêj nÊ á 5"h i`¸}~î~ÀÅ>ÌàäK"¡ûe¾ßÏù~?éÂk&£Ç U³,×XlôbÌRWUOÚ¾¸l y0N \hhþRþ©.uöJ°Ð¾Hd£Æ%E«PîæWQ´ ÌÞþ ÀµphE_¥&Kg. ¥%/ÉM}8Ëbaá@þÜ :Îi¨ëKxUaª¯W n"6@'¦·ÒÎâKæj¤APØMÒu¸Hl0 ;*Ãè 5N1³@Ú$6 VJÄ£l}¸À·5ÊU0 éÃ|Á ¹ùÿ ¬XÉC cÛp¹=ÙûÁ8â¿ âÖ¸¯ë¬:?x4~óï"9 y. nB!ø ê¼»1eZ (h SiÐÒ¡Ù,pw* %Sk(> æZÝøÌ ÅT¦<xtë© XEÝSjéÒ?V@¼dÏúY£göfkíà ÒÄx)N%xÓYaq´º tèÞ«¦ÉÔR-éÑy±çÂX4w 5Ó ÞÍD 85³dù@X [ ÐY,í w ÐG¸½( ®fÜc§äɾÿ rꨱáuþqATcµ5g7¤èC 8 ¡ø»ª¥(Àì&ÜôX?L~&"ÞáH wï?Ha©ðÀ÷F OÌó. {t3×û|¸îÝ zíÿ 8¹z6èïM?Øxh¢æ #ѤS£µ@¼¨©U«¾¯qÈtì¼`%lpjÜ)Îãè¬4Ú?F0rGÀ;6GãNæ<=tÄ Iª:R ¨9TºÇ(@üA×¾cm§jJwEÐöÍ1þ2ÔVú_^M ¨Cè8_ϼPA<8³"T°HÆçJ ±@Ö§ÀRäbñ0o3ìÎ/« WÃõê7w" t*)\ ²/ø¨x~îPõâ68G>§x0|«óX_gã FÖ7Òa0¡AeÆcmËí_¬Úíà n @íØp¨-avZb¶Õ±!AØ?X=ON½Jàî0"Á ;NÄÓÏ.¹í4iÁ]:iAà oïæb¼R!zPCªKø?DTv+°jxéÜ£ {ó_£»ëCûÂoNî$³ ï{mÀ¹5ѼK¶+v)TúZë ×FD]\Nù·Â0¥ ¯Ð:¦-EÃF:É$òL Oyõ<Ågã>£6ÖT VíHË{?ó&óÜÐ:MAÒ¬3±Ü /kZÔȳNKfÌÙtßÞ<õ#é¨p¡¸ª~Quyÿ Xkõ×®ñ !N¶: ´¨+ aZÒkt˳p/zPÞÒRXÜ@{úUø2ëêêäõ=G½U¢Pów7§ÔF]¾HýÓ¶{Zÿ °«?x JÂ2°Ò+ ¦ ;i`1«¯YC¥¶ 1ó ;-C±4i! 4Bª´ UP]Ï19áþ`9g{Oð]Sö]åð¯eâ¶DÆÇPÔÝÉa¤0À¤dyjS» ôdÑÕn¡ K¯a мH&%© *ÿ ÚæúΠدgï:X«ë(FáþðwIZ¶ J¦À°ÀÄ|#©z ~±©¯1.4Û rbHgÔ#c¥ÄYA`i.#À£5.áï(;«>¶ qɧúDÔo)Âà§à@d ìg , ÒOÊAÎíÎPIÏð`|=A÷o ý`5v\}ݼ!_ Rn*h R@\é@ãZè/§n81( )â6ù%»¨-ø=>_:Ñ"ÅÙF¦© °mÆÆ9ÀT u¶X~¨N« SÛ¶6ËæR«RSX, 6 úU^)0[𵩽b,àµÃÂÍè N8s®Úèµãà(¼¡\AîÁÞM|Ü 04çÃ4ÏóÁ_5³ó·$i4¾d¸:64j&´` &¢åL ôÑLnèðÄæÙ:8DêzÆDBa¯wG0R©Ü#¹PjT¥UØÜDÌ TÙ®kì ¬îT/W p)Jªáah"ÅZóçë¬%ê×»oËmq4P!%© DÀC@ ÂFuvë`ß»åøÞ.Ì©ZD *×ý}ê¶2½Â<<eKUZ ôDøлÅÉóù*"ggxÝ)Ú èH½©NØó} » `©]5¥¬å¦=³,º¨. nÖëX% èpÇØ"àÃ:1ÚºDØâ²M/V¿³á´Ãm¸giäÏCû0ñÏ«5 c_¤iõíozßÀ 8b¯z0Ó³$%lc=éÍà¤]0¶1Èï®$²Ò/ ]mØ {? A-Ú)W«UUP4Ô=ä@P¢[H, û¹å£DaB!)Ûk)OÒVR»<bãô¡Öe¼´|¶à®n¨BƲ¯7¹<ää `&écܲ,Q£ºÈ{(Ô A]qà øENjµÕQÖȧ©WÅ^ ÖÛÐ £¦FpÜØMHÍl×g¼ÉBoÈvo@]Ϊh nîÅÍ¡A0 ÞÖ¢"SûÈá >¶õ5MBWrN¸@oT±Ý 'ô¢nÏSîòx?-ðW¸áQ¥,ý «à9¬Gö|àFbÛÞ`ÊYL¦ípP|8×ñ.Ë$( Ö*wöþó ëë}¼Á?·É .cª¬bSáÓèBÞìè ÂhkÓX6]JG k{Ôn3ZW/æ%I' Nã t ÀñÊ»°ú1D*Æ*Ð 6¡0&ÉÏÈÿ x )"µ²ßè0ü:øÆ~éƤW¨ÎY±FwÖ iôØ×âFUñyTy´ ]\h"'Îé7) ,¡ZBmäq\y kÔ?VdÖWUk@çÜ â¨$*Di[+ ( }1Ò%UÖð°"8è$U!V3ÆûT°]h+@'A:LãK×@©£UÁ!VhFDU²¬"©(í 4SEÁlÁ.ÛG^ ((:wÑÆ>çÐdBóþ²J'¯FHõmÚ5 f@» KÙ¢ 1¢I Uv«î4aè)ðdï\@ ^`T=ÔU1ÍÁ}¾4Ha ä±¹ k#§¡ ! ¤i Ö@pè,ÜU°"@ Ûè3P tÑpMÌ£Æ`g C,ob,éD×t)j¯ Áhðiùuc0S¢-mB;·£4ÍA¨XÊCø x ¨Q`¤Æùvº{þñý) ]_°%öß"_aGÇáh¨B1GäO» ñË?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 19219 |
| Response Body - size: 19,219 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ¾¡ñ¢j4ëÝ1«j(: "N HN ZZ2íVöû·£Æ£*$ ,A£e¯Ë$«s4°óÛJno¥ËiªH*è wÇ7¼ÏÅÜÆXî}Î7©Û Å5[9ÕkyÝÍnæDèÓL¨ÚH2²r>¿>¥íݼÍv $V®á¨:¢ `NËGRªoDíS¤=}×DâÖÈ0r"HR·^ºâjå±c½ÔÆa`ï$Øm K5ÍísyÞ¿¾½ü;$ ¬´§Ø9Æ2Õ©gpâ v ×6v·?¯¹Í}ì{¹ïªúP0U§^,ÜõÞ\÷ß+qÆäXºãµÛ ÐCs#AÊ~¸ANÄfNååô¢±ÇÝ˪µ¯WÈÎ]¡Bék/*U'c«r*ëË/AQköiçÓWÒ,+jV½G|uq²¢v`g÷äÏça\Ê¿èTw¼¢$U²Ñ`ïTÀÎoHçÓz WÃfÛ·J7þcMغri H"¶tcãå Ñ×Hj]=òó7qi¥«Òù_EæÓö5 e6?©cmpXP·wÑ,ôq£Ï è_Z·sù¼ ´xÒE¥2wÛ9º úôtdëzÎÅ4«öD' lèÐål´PK1æ¨ ]l³Üù¦zÎe"äì<߯½ü¯cFÛ :VÖøg×>[ú4 nã´ÍWô:8Üí,të·UÑÏy×X¶ÉÊÄzF³¯kIÑ£yfS¹6ÊJN¥[F§oO/I1«Võji¹è\GmçØZÌØâ ÒÄR{Ï ¶ØB*¤S3B ºÎjÿ qB÷Ë®êfj2OnXe 4í$ÕÖ |ic¶8åoF¤Í ±WX` ȼô±*9jÖ¡íy/\þÓêà Þm£wô*º%κjuoæ}Íîc§@ãImq o'C9À6g[nÚ¾dc{TÅЪ¹µ]Lm9qõÞbÙ[ ^vÛhXÏi X;Úi.` -R¹G ÷¹GÁRsû¯?ìÂÛZ&UË´8ÍÌcñ¯-HÞ-Ò V×;Wcç[rÜ_¡pûÒK0_z¢ÔÕ¦-}+¾ùJƶq4 ;?B¨¦¬ØÓ.µ$\P£®±£BSÂl2VÀ½Ìk©cë>QèjÉ[ïçÇïF¶µåÌîXªmbôÖ3ï3Ôù8jÇÏEÖ'T´ô ÖiÈ`7 BÆ6µ>Mò°â°> é^kËè6ѳᤫYÚý Ïï0à궻Q-C¡nH_Ç]÷Ï=)mÈí®bÛ h<ÙÒÇhVÍLÐøt ü Ü U }´l@¶qÔ §t?¹Ð'r|X1´è ]|² p3ºð ú{ D2¿=ÄyåÊÂÿÄ * !0 "1#$2@CPÿÚ ü.ê¿ùëãÃw~@[PZ7vï÷áÜmZ[ZYYWÛq>7bi_ATßÕs-Ê%ZüçÝÑUnØünÑC«°,oãsZ·U¯ºå¥ }¤UQ¬ù-shD~ï¨ÛC /ãs´ßãq¢4=t¬RaJû®ãíƯ údÙ½~güu@6¯"®{:¹¿Ç$ÿ Oíc`¯½ð²µåãtQÑææᶪæý.ÈëØ9æÛ Ö ²» Âêf×î.¥OsPT [F#Î÷ôäÔ$/ãÆ ÎõPÝÖü _²Ù¸Më(·.á G TÀ: ÎOåÉ~´AÔöë«hP°Jº-Õ72/¾F2 CôÜeV;ù,¶±Jc÷÷»¾ÎQZ_µVS¹ §¦Æóò¸êGF´ò¨ ØWÊ/®êXÂHÝt]hrrâÈËãÉw²<2)½áÜahxFU 1ü¥Õ×æƱìÅ̼Kð3Bq?õû.\hQQmu.7?òl/nBkunÀNÀ´ ggXÿ Fÿ ;5 ¨×]óÀC;¥\kèÝ o¯Ñrý. eÕ³ ئâYò<gºg( þÞêw(V'$h÷pÓ V AòV÷.á\it;ÊdÒò Zê6ZÐCâ¿+ô¿K ãvÆÆã8ñßÇg·± Å`¨Qþ&ê:¼Æÿ TÊ3¤z¸ª f ûF^ÄÜÛ6³öã1®åÄE`Æ2ÛK^/Ä_Múñ¿! lèüWUañ˸¼ÜF}Q-ðÙFóu ðð°lßΪæý·Z*1eåâ4?# ÇM³jÌc(_mjî ¯ªåÆÆ©£Z¹¨¯*òhbïÆÂþàd+b´Ø]vw·³¿KUq OÝËdØñy&ì|± òd*Öò[ò¼M!(*ôÜÜÜíøoÒåË.£tkÜë |vãq18am£!ÌGÅ¢ô¸pÆ£>'kbr ª»TPÐÕzoÔ®-¶· ÕÍþ7.(P¥Ïç@Ì6qêN&Md=|rµÙ®2ñ¦ÎËspÙ«ï¸Ã¦8o?nm=?&²)£v+ð"Õ @õ_î¼[¯MÍú_¥Â.Ë: rÊú¬\QYr¥íä¢ø¢s+ælàâ9ÜÐÀ§ r~é ÀÇY1abÆöÆ¢øÂeÓòyËJ¹¹¹¹¹¹¸W< cßp®Y N¹Ç!êÄ`²®©¦Ó,ÙþtÚ³´í 0j/0ñYÁ5Íkk<Í,H_°Ô^ù^]£æ ʹ¹¸ÒýDî¯sp¦=wuyÉMð3i7#É´.AÝ»8 ¬ LMÙ@²»6PÎc òo§y¼¦-Vp V±ø\9úÓ}([[¶ÐÐëq¿Æ³³¼ÕCÛrî ôݧ;!FlA6 ÂË#|¥B4æ_ëkäÐ}³±}ªðnwý·Á õÁÌGc4ãk1]£È¿íJr¯Öî\`ÑKXy±-m- ]Ê?¬[-×iw *«Ê^Awø¾'(ʲ²O®&u ÷"Ì 33 XüxO(T3ÿ BúYpøñräZ²d*æçiGóëráÁÉjesøìp2få~æfä3 ¯ä1ëôSwrîXyÅâ0 4µß·N?ºgüÎe?'²V.e¹jÑ @¢áÇCí°²!¸»ÝÕÍÍPãõESsrå¸"Ò. Ìò¥,ËÊw{s\7ujȧës:ïÒæN1ë Nªÿ ^i933*Ünwxw¾8üP~fy§?Îì%Ë]îGÄ¥ãb`[ró«P âPÖå|ÜÜÜ»DÂòn°ñ]ËɬXÕùPî2ÆÆøR¿6^H¬2ÈÝÁ+âX.ãEy9*,á¬Ó t ä±Øöåcx©UUOÿÄ + !1" A02QBqÁñÿÚ ?¹s(_ú/érþ£³S.ÆŨÈWÏìȵbo`LUóö=0dsÄz /Ý}=̺Çù ú_}ÏJT6È;s6Goûñ 'å=/ÚºO3{Vù åJ1ôft;|JSô»üN?_MÊûuæfÕÉÈüaBÀ.W£ö éì0lg¨`£paf4&¾oMåÆ YjÀÆC 3g ãø¨»,fnjõ55\?!3räyùûQ¨ÄßR¼2¦ Ц¸Å\ ìy¤#!iXãj3]®CÄ°E´¬|ýî¨~Bæ®×º8¼ÛÈØW¡Bç©cß`cb¦ÄÔfg¸Ç¸ÚÀÜÇQÉ2?D[3>¯²@úÇ/3K^¸ÍÜMdÀÚj[ó3æ|¿Ìý¢ká9MLÇüüCµuQ2|. &` ¹Â±z°^âøW§ BìC7°Ù¶n¦E£*T©PD5?U »ðãÅb½õ1õæPêRsiÆ&6æº7ÇBl¹3??òTÇ ÄÚÔãd2¥A,@f*±%õ?°fÆ·% ±QqàÂb \Db îläöÇBfØg^&*zv?ºÜcá8Í«=P2ÌXY!@@¨O7s5þ#kün¦,Có0 ©þf|àÆÕËí5Á®¹ûeÔ( ÌjQ® q±ó YÙz Jó¹K±k Ö¡"ª{?Çêd¶±uæl\¥EYt'¶ äg³Os ª¯S:ÛOjùx¬$(îsùBHz Ï Ìñö Ì£õ*fcU ¹SUC5©ù©ü4 âÿ ßýL±¾æ^§ÿÄ 1 !1 "Að2¡0Qq#a±ÁÑñÿÚ ?ìÝæÛú5Ø C@Aý+q¤µ®@Çô5ûUrûGÊñà=8h|ãÃñÀmsÁT<£ÆÙñ.óf[éüÍ3«/qànD¤(müs;ñÆ=f{uµ±Ç¤KÓ¸g ±;å(ÐÞl Ä.-³jäNðct̷̸馸!éé4öóà¾é¶iun5¼ÔÞ0bc _ £!ûÊÎ ¿G¼}F7Í Ê·#óµ @ UÂÅÜ%õ°ÎÃÍmÚç¥(Ájèf«HïN14-Ä^íÉ E°7O F Ô q^ó*%ÎÜmÆfË u¬r{IUÂÑm¾OI®pWvéðÇDMÂ%é«;z]I_Ò<VÙ°f[xuþäÄÑ`Üæ_¥ÍÀt·VÅenúbWøÌ:öªcPËËþa·Wõ,6¾;¦÷ïíIfÓ´ñ47¾Uæ)ñ4õ©È Û5` Íc ð2eM½¿oÏù1Ú¿y\t:*õ ·f¥¬bW·ÒÆp%îPzx 1¸1>S5:]°ncm ùûM6¯k8ù ËQ·nS5fÕnôµ±+ÔMfß1o´® Fܽ÷Åg¤MÌ&%ÆåÁyU¥Öþ²C+²Øf¯vyäF^ïnà >GÝnäÅÔùöæZçÒk/ry@p¿Lªµê º»ÕÛ,Ô>7%zì@ôæ1ò¸¬ý °ejç$MF¼o/úDn _còG÷ ½}ÿ 0é =ÿ Ü èûg ÿ ò.¸ )Nõ÷ïß¿Þ ©jÒ¾²«7®faFx55-ÜpfµígÆfá99ò\¬²á§¨ å ÄªÔ Ùûû1é&¬ ° S0PþÓûO¬ØÜEþ ¢ôGïlbÞ2-ëÍ[¨²úMe¬µfiýæb²Á¹ÿ ãóQ5CÈL¼#øÿ sHæÛ¶·¨;6ÉIÝÖÿÄ : !1"AQa 02q#¡ðBR±Á@rÑáñ3b$4PÿÚ ?îgÿ ëü± Ü9ÿ !¾`°¶ð¼A(t[6úåfûNÞº8+"<rKAVQp§/3¤«ñüüǧ0Fº *#yÖó?]#ùvÂcí÷,2éåÅXǶ9µ ÓÀ![x/Üx2Dg ï|½¦ `ê¯=FOª§hUg=µS duãôQøxx&ÝU{ Îë]¡û?^¾åôÂ%¢×îN3 ¢ÀZzøäΤ ã2:î;:ürF>¿ºc ölîØ7LdXÛgbV§ ðë83ßph¹ÜÚÿ vâòÞþ¢ËK}c/ºé3û.ùT·NãG3 æÜÙ pÙ{*ù5À~?E³°RÉÝ º¸yf5âëÞwâ¿Ðj*ÝwËLÂP' 'i>ëd'Z÷JmRØâ¡ûÌkþÔ¢Ê ÜùÂ=0¸÷2ù~±0Þ^1Ð Àò÷7SË Ï!PÕÌóçöMÉ -Õ 3ØÖ Êb0·|<£h ÃT6Ö7-áõXǯU6´W¼µÀÛ¿lÊ5(Ú]ºiçÉV©RÁ³Þß;¾ÛC¦8ýxê±ks¯ß>×κ´ýýá L@^NJ Û2°÷þ¢sA9#4hìäg<|âV9Ôj7%墻¢##$¨q®ÍÃ0wÇ1âÁì<6Ó{[Ã@ìôûÕÕ¦+RÌSkU?á©»!ÆO *±m;«ÜÐ1)®$Hok ôU¦¥B&÷ÕS}£8'6« 8Z±§àZ'S\Àn÷ ãÕMÒw´}B.×â¶ÞÐò×4\Ú|_ÑS¡¾fòÉáÏD1 9(v$i"Usí/$Í2*bÚntV:ãXê=U9\.2{ }íaë¢eJmptúª´j=Ì:OÁ$uð¹ .·þÅ2HFpGtì:O)RÙ3'_Íxth }P}7Ò ßºg]U:t8cDj±íHTÍP÷Õk-§¿Úz({EìqÆ?Òx£L[¤Ýõì.c ZÀw$è¢{KmTÁ¬ËðD3¦h{vÏr¨ó+ÏJw`àã¶LrñìoÏ¢-ö}÷?ÌíAôÞæÙ?t¸\5ZÇ#!°»{¤KOÍRo¼==ëU.Æîºÿ nÊ Ú%²3ǹ¼D&ºñ$ #°D6ìº[y~«hÀE¹ÔÚÖâ]® ¶Q°ó \ê¾ÚP 5 ¿U _{væSJ`T8x8Þ 0·xàölhCoÖ5+kE̵°ÙcÕIt¥=¯uØ»° îH²Î¡æ9OÍnd N»tsÓ¹ö $ Â-ÿõSB¥7ùµÿ Aî¼3£Q÷ú*Û>ß3%§yløLªsKörw±õ ïö'7Ú+]Ã:'Ôtß? Æ©»çt!q.}¬{XíÒåúöØ èRÛ÷Q Ó àâây¼ҵÜÓÉ´¸âÓÝʪ:ÍM:ü¿T0좶³ýéòܶÅÎyÑÃ%¥ìÏ e>£% ÉcôTöu)Ó:<ê9 qRÂtà2·Ìäa $Ï´NpÚ:ñÇDú;XQ1(¹Õ=ÿ D Õ6«ÉÃV¿õM§\[v¼¥lö6È ¨Ã`.}¡ó -|QuÑÿ ]T¼ÿ ãÏü£"ô÷LDáÐu_ûFÆ*@wÅH$pRpÞóîüb8fZòbõ ÝÞØçÃã趮¨ëGáhm¹ß ÇdHïºDÂuzÛ´F ¿OÆ © 5²mä¬è ÞýUùêîvàÊpi qåàxjÖ`nkhÖ Âp8½®ÍÛ[wµ ÒÚXAÌˬÀHÎRe[êió⦤ÖCÌü¹)3¦æ±.Ü> TmSå6·ÓónæÏhi0u mZ.¹üGÜ¢$:(g¬ÆfZ2YS}Íäc+òõäe¯.Çt÷FØ.ø&3ÈGrÅï4fìôN/¹×béÑ ó*lªóc ôMö¡å©Ãy ðï [fª c 2³éÊkè{¦w6˧öãÁlÜÇ 24Ò3$ykLÁÈÆ«dlk@Ъ+X qSl¦ÊµÌlãEL ÎØ5 Nó©º A¬Qu ®ØZ^Áu§"e²-'ª}IÂæ»GZuùGZì6 µÏåþ4PüªÕIí:|B©Q²iÌóTö hB$º_ùÿ ÍS÷Îóʤʣx¶A-á÷)ΧçäÚh$ñM± z'C`©NkHoÁ7½SX*4æ9&lMÃ%Î 8D Öá1æÜ7xö[¨ÔOÏtÐûaÏn0kxÚàÞ ¾ÑRô5ë¢÷ta Ù3× àt¸j²ÌCZmpý¾©îÖÓç|4BTÆ?ç¨_ÄÕ4 Á¹!ËX ÏsÞÒsú¹ÙÌ«º \Zà?äåþ>H8¹» @Ô¢Ò 7 "ÓæiÝ(2Ð<õV¼gΫF¨Þ ªQ£AÆóù ºèíKG4Ê©¾5# 4Ï~ÆÄcªÙ¸ËGôqïÓÜCë£ÚÚpdÀþ^¥O+i7#Áj2y Û^ÀDÜ[Ð}¬DGßúVµ oq=;0'µ¬Ù1%KÚßépÊ-"3¢ àúx¿/dá>ÖÓ/Éûê³- ÍçSþ&ç541 ¦myð4BCf7ã#æª2Ïví øpûÑC[å7 þ\Â$ "ÚNàS:ÑÖ; gµÅ¢mê:YJ«qaÕÇpÜÞ}ÿ sIÏ?ÑwÞ¨ ¯u @ Ñ@T.uÎR«)0F9rìWNû=óð-'Oì®ã~]Ýß $F§öçØö¼eÞSÈÊkZt<Ó`Eã «:ýåSÖé$e]§ªb,ëQÛ±Ë=4T¨û5+0^x©eGT`?1Ñ n$Ô3÷Õ=u73_kç L yõp2£ØÁ¹ÎѪêθöÆo¼Á/CÍoeLgºXþHøËèþ ÝTÅw<qj© ËÓ2^N¿sC't¢ D4È í²Ýâ¥ÇúöKL±}&þ1?Ùp¸+]]òÂ,tÂk;1¬è7äpÞ?D ÏÿÄ ) ! 1AQaq¡ð ±ÁÑá0ñ@ÿÚ ?!ýJWÿ À±ú§þ+ú !$IãªßÍý?÷g% ýÌbBIB#vÊà¨p×ûì`þ¹ôUÇôØÅ´»ßý~ø:¶Â2w®WÇáÿ WÐÒcÙ ¤9 ޣˬ¤,F¿ÝoX§'ôO¨2Àääú¬þ Tâ 2-'ÈK&sÌÍÎBÿ g\Xp`s& !£nökyk~⥲O |¦ qX?®KRMÈç4C;ú¾¦NõqcôO"\cdöb ]®R×Î@¨!îsÇÓ56ÁQ_õq P]a+Bt<½ uÖ|[Ô/Î@ÎÊ:×ô}1V999>Ä+;`&j|*+8÷äf$¿P+¸ö¶÷Æ2ÏCÝÏOa2HÓÐÑË>äXĽl,3³ Q rÈ£ !dÚÙíh | $ÉÉÇYh`¿ißO>Äj21CDÚ-PMÆ,=ÑɨÚKúDÿ <û¿C"s$ P6{íO,ù>H£x|=}7Éá!ÜuW8tô8P¶_W}d¾ ïðÎD?eO¹ûb$«åX{'N.iÒðà09 EÚþíÁ¡ÃxÁ¦a@ 5¿ãM&*|üa ,nQ # `%ýqI,ë':L[xÊÈ}zràãwÅÜmý°Ð)Xú 8¡ûå*]{Yñ.ÁÆ Ý-Á9'7 ¡H×M óÿ ¸Dv~!¥àýðp+o'] q;5VÑcH¢'l ã~Bº$r¶å ¡Ç ã# 1°Ô ªÒu>s&(ZMILVÂ¥S×¾kEÚ·Ùã#gv¸zO¤ú¸ë)Ò2K4§ w'¹. ~Gì0½§No¢ÌØé0¾Q8I êê(ær½Ü4hI ¾øÁF@+q#öɾ[mÉóíQ4CQ ,8£8³¹)5ÈöiÂàÔËÖôÍy òQ'h19 Ê ¼@ßõ #-{!Ç_à?¡Ç ç ÜK]vÜUQ×ð C)Ûmßq8VRoçóíz+(ÜöÄNËÃZ²¾?פÄ7Ä#< 0±DºÏe§ô¼*·µp¯El<u;Âölà"7ô®å8$ ÷ ÁqËÙq°\vÇÍOÂG"}Y»áÙñK§ÓËs¨q¹¼·ÞDÅ Éôÿ %2YRý?K(PNrС|ÁÆ[¹ÑkunSTh¡÷DsI@ WFvdõI¦ ¶Þ3áë'''''Õôwð`Ál³-HÄbA)¾rgCNËu¨ ºxxë ³`ó¼¤ lFýÄøÖNÞCðNKVf¥Ñmd .gÇ/ û´×ÆB@± ü¼Ïé''Òcøe}îÚ²üå\ó1ÛQrÿ u?é¯%(KÖ F(JÜK^ ÂÐ øic¬× 9Mà^¦"xb!4 $øó£ÚÆfÓJuægÄ`)«ÝfòÑ]ù2·¾ø U¬¹Q$ûßÑÀÔtBsq"K¸-måç$QßOéÆfÀ7/ ùߤúM Á8(]ú*pf Û5çÏïã 2I9(?5#2¡'Ó³ÛPáÙäåyÁ$ÞJ©IHE¶Y5ö?r¦ûÑ E`ëÒrrKOM1G¦ PíI\çãqñ-Ln,ª¯¬îì(Ýç§ör&JV.gý÷[\vÍl§Å¯8Bª ηõÃ]µ¹0&FpG¿ìÇ!ËÛ©K ÈÄès»GíÖNNN&ªðÂaJ¸¹ºñÉ]áöÁ@} d2;©¸é 8Ù EíßX(DÜW:M?t_÷ ]í]OJ{ p©7cE]Ö¾3iúWÕc¬qÄZ¸cÄÏà\ ×> }ñMߥî?°}²@¤9,üý² FZ4Ûܾ+¬Ù¦®0X½503@ò·?ù6´òR¶>ºûä9¡TÓÜÎdItfBã(BÏ¿{rsиQ 0 ݧ¸ß¨©\@@`8¥rs|s ñppÚm× ¸ Z ù«'x»ÔÓ|óªY<ýqAä<è>´s #VÓÒ>xÈEPñ0HXgGµbÖ/YÉõ_EéH Nq&3¯$°ñÍ)âzñxÂ"äBç&<I{òà0r)ääË@f .¶þìÏüdKS$]ßËÇH''Çäb²¯g½Ä÷Äk¡g @rex KØòÀºu0ªäÿ 6ºÚ[ ÍorëßÙÊS7Ö%ß».O¾þù4öâá©üÖ Hi,B`¼Z?yâãxóbÔqnCÓÓHÁÆAíòLè 1sü¸F D Ð01Gbqãüǧ5£ãó47%àÉ¥ ij1&þ"2¢¦59nqqå¥áta&&¯ qU%A½i¨-úd Ë?À_Ê(¬4Cqro;Øã®ÃÆ2fú`q°ô)èø2±D,d²}ôß5Í3O@Þk&Ø%x3]6G<·SoSÎ2×°^ÑκÅ8 8ì§ØRs÷ÔoyDkÏ?lè¿ /£zrtx<2æªÏßøÄ2!Ð èøû̹va§Ùóç$ r":EÅ}'â²"5¹(3¨2 Ü{Í`Kcx f3ë6G8Ço ¼á©^£R(|VMFDÙ»Ö^¢Î(÷ô~.+ÍÍ&9Ý Úª·ë \{~?muIÁÁÎûÇÇë¹ëµñßv ¢_Û>¾ç9_¢nQ{8@,¢ªwßOÆAX«qQól ÕM?\nÌ_:æzþt -W÷.KvK}Á'«!ímAæp ËQäùq 4&ÏÎ?I}*ÆP7XO¿ ¼R \hõ0Çã 0ȼ` @±1¶ãë^S¼8ñcÍý{©h=8(P §ÃÉP8<°ÁÖÀ7¸ãëXÐ0lK ` Üÿ 9Kɨ`Ä,*¢KX7 {8âtÂN½A4íPú reÂN\ůd^7±H ¿Ó **3øáHS_äè$S I=²II·õºàÆK Ù1°äë RÚ=ÉMü1Õ JÎÿ =bôȵÞmf ~çr|9~q*É ÓB&L)ÔൠMÕdú$ìõ߶ ¤Òûc& ÈKs~\VttÅÄñÖóð$ ¯Ä]b»øT=ò)µÁ;Ö6O$q Áã_CtL}øÍ9 OÔ ¯-¾,*Ö FØ®Û}òh$@ûë)SYÇÖ~¹4OH}Èt@z\80à&)ÇN8¼¾uî´Í Laõ$#íÎL299Ç-bJ\UÛMª¶V¤wÞñ´ÉUéJlRG '8?{U|>Ùp³ùÀ¼ÃgØÄdJPcoûÖR"÷¹Åæûgqªq|´\>0U'aÆÞ9-Û'ôÄD æÛðòã@Ðv7 ²Màݶoóò¯àOx2 Ã+ý§ù^|b½µÖ~?ßlµgØpÑ|ÖJhÙ&È÷?ÑÂ0 yf¸ë$÷ÎÏ^×5ç DWÆ!Ï p5íò©ÉE=ß)³ÚxÁÐåX ¦$ÄæzÈá[r½U»ÍôS Ûõd&mO³æ~5s$µÙ.ñåvQ,xbj!åöÛ¤äfzUÙ¹4÷);ç;kÈÂa*|¾Às 5ÒPÑÖ%¡$Ø×F·IÆwFh|t{¹ Ç{·ôÄdOÂ|aSQu_¹:Ö!Õîo ¯ îç÷ OHÌrË`õêç7ÈTr 1¢! lxn@z {{9ÎJcËl/jGñ6v³ Шykç7(íÉàR'-ðª;l~%Ï 2ädY/8³¸4`=ðÃÀóu ¬\ì:ºâðiËÜu¾p+i;ñXÌü"! ½±â/´æw! ùÎ,¨bâ>l,Fìd»EW¹§nÖ'QóçÇ/$X\§ Pò÷õËÒ /× ÄT,¾Ï4ôm6Þ(äÀÒdiUîc) ÿ !rX§cô§v(<ÔG©Qu0]G¼± åF)YüXÐhD v×͹ï××êJþó`«'Ù;KÖH¥(uÛíJÐ]Sq{:sÎ ¬cH_ÒqQ#¬ò#ÉøelêÝüápRØB.§,»ìêâïa>Iþre6®sÛƽ³3U¹ùÞ*M¾ ~ÙÜâ"<¨wç! )ÄSÇõXlè*+ãX Ä@©.8z×0¨µE½ 2ÿ F©é·Iîc)+l éQ¼3 {VgãsîÆ¡+*J¸<<Er Eµ~ÿ ;& JeÅóá¬,"u&§ÌÎHË×(Rý¿b³Ê´9ãZ¯0Kf@ # û;ë/õÔ `¿ÅÓ¹ïÑ/]3ÝÀ ûþX'äaø~qeòpj¡9¤£Ç¶"á¥. oQ>ÛÀAJÍ8XÆpø'yH§'3ÿÚ É ë=¯ú?wÿ ÿ ÍÅûïÿ ÿ 2ÿ Ïþèýïã Óp¢rÀ£Ö<Òþr+ªÙÓ£ø$Á$¾½ðAíkQb Ìü:Ù*+×ßÚ®ðZt»º¤Z'9þÀ¨³UmwâQÄ4L¢Oúyp5ͲsKó_Yßo<»WÞ| :BF\þ,}+Hg=ÎZ¢öl5?ÜtP¿¥{ÍBìSɯh â8þýп~(öò/ÜÿÄ ' !1AQaqð¡±ÁÑñ áÿÚ ?i 4@ùé^ÒY)âZ¼NgÓ¯Hî.\¿ ¶²¬{ÌɾÓÎø_nê>8\(U pÛL{ÜIR D+AÒaà-ÀK©Êááztáëùã ýó.\¿7G `7 \¦:ñ;é7prÛ|(j\¸7¢¯sZ l@öé}eȱ Ûyúë ª uë-DTÍÉà` èo^oÊ [W= %IÌ-oͬ{Án4¨S \j¨k¿hÀY5u̸ÆC¬¼¯^¼¯hu m߯Ä((ë³ïrÆ·ëþÝÜ+çëç[qõãÏð8éZc<¹Lߨäã[p©¿]¾ù,Ç&Ý÷ôÍÒ_xQ^Þ*ç¯ßÆÒ2ÀW³ß9^àpBRL¸_6 kÁËßÖt#¾øGXk-o}+5þ&<J"\n(¬G¦¢ôå¤GÞ;ö÷Ô.¼âDA($:¡.F4±¥è9ï×¼Ê6V» `õçÄ!:Ýs¯ºøbÔ©VAMíûçå(׻㱮x_~¹&¼_®ñ±¬Ñ6sÐë¹o È@Þ36I%âæ eÑ¿ÜÊ¡W^_ õêô8ÿ Ía"&¯®1tïµKp1 Wä9ðdEF dö¾÷é;ø ¤u2LZbIn®:c]¯Ki¼' Ê{@ÜmZé¯íCß{ôGEÀ翬Ï/£wëÞ+Õù·àSä¥`ÎûÌÚk {ü3ÞÑ@µòîúKEÄªÚ ,]IÊéÿ aª_}±*ÞÁÒ-²¢ Ëpâa+1iM [ñ¦<ê"Ãô|:úó&¡å¯}ó²Cê 'ïRÈù?+»«¾ÿ ]2yµ¡Ý@ÄÛ·¿}eÙ ÎÒþ Ö 5 1en ÁP jÅ d ïïÝy2´+ó©§ µÑ¤¤ E[LüG\Öd¸ùFýe.ÖÊA¥¯F À¿Ù kóö عâ%|ÌÖÆ,CÌçÁÿ ¾ÿ ²¥\Ö ³ÿÄ ( ! 1AQaq¡ ±ÁÑðáñ0ÿÚ ?m ûÿ D8©áßÜç C¥|A ¦cßlè ïßEtÈúQàëW±ºóç¾æ ÈÚ½j®ýÞµàÑ;c£ >y8¾¢ 80µ1ü½5dÈ,L 1H2ä#E;п ð¬ï÷õÁÉÉÀÁ1Vf8Y%:i]GLz£úî[ÀÁ*ïÝbtâ7®ø$Å â .<Õf ã®øîN! y¼út®ød¨öøÿ 0[«s°(rX7 K=«& 3EM{äx$âá]úuiã"I®30tt9Ú~2¿ßIpfÉ<öô#¡=qYfnµ¨Ô]»««¹H¸µô/qXÐ=& ¾zõÙæ°Gy<GÇK¼à§PÉ W¤Ø»? ¼Õ Vfôòó ãË Æ7Å»¿JÂéÆÑÌ}&q£ 1ÇNÕ«D`ªÔ§XêÕå MÈby§¤ÎAk'O×÷³b^;ÓK57£]\7QÞ²q¢p8SÚ³¶+zuítÄ s®' Aòtí>W4K ÁMî&«¤ó¸Áú Âù öÈÈ::ßùx}î/>½±á@êÙ:iZ7[8 ²Ôíò®Ç è@2 x9¾W)ô²½j¼1c|ÆþÐóSß- +ªòzÄöï8è300s'úì Of?º]d"1²"µ´'_ Âr| ãåÖKG-V$æà&Á-×N4§¾NLTäû'ιÝ+ï¯OOVVd£ óûÎ$)¢zÅvfßr°Ä¬ßÌ3Ïç;ûà \½ñoæ<Ïc¬ääâø ÈNHù ¾æH$4ÍûÓØy`Ú£Òå Í6Ê\ÓÀ éæ>1£¦b:þL (ÑdQØë}¤QK)éÇ %ÞA×Hiîå§Ê'ÛÛ\àø4 ^zåY£DaIÁé#b «8®~ËFXzó §)@L]ÄÍÖïú±+ ÕÌ?<ãÖi7+ cÁ ÂÛÕIMîcú0 >ïô~p`ëÉI8²ý=>w$Ô-#|Ô×¾#OlX8¸lýðú{`^¨qùøónäÎ!ø8¸5"L½ üþ£(G#pÑ Q|K¸Þ, ÊðIg£X>áWÌsCÓÚÂ"ª¥ °eÈÿ O#SÁ,¢µô¤Ä9ýDõax«v~zÔÇ粯°DX÷ô Á× çaOÊÈ]ND-F¢ý4möM¤jgüÁq@µa~ã¾8Å2G\Eýýøä®õ³ÜÈ÷H) h[êfñF´x m Ø#O;ߧ£¡y+a¼ÚÊÍþ£ ¦ýg@Ç÷_îq àíoùìd£'RßN>Ð öÇf={áJ.*·×¯8°d{Ïèòâ°$Ô"« ê¦0A £f ¬¡eÞ¦ü²IR¬æ}5X 4/÷Î8{ÿÄ ' !1AQaq ¡0±ÑÁáðÿÚ ?ü_ÅIJ`~Õï Ëþ Ü4 ûùþÇáùY µü[GðXÆ° 7¿Öh°âti`@ØíÃr¹råËþKqæ#&; ûÌC§>É hiYîH ×þ9¹7{@7M µOPiüØŸý~~ P_Ë¢½pT1ÝÅ53Äùë¸q©F®Ð ûàØù øþ:ÃháT¦ Þ|þñUbg VÒz²`Ä*Îj¾(:EG0ùeüS¸³¹¼´gy#÷÷ÄÅ^¿5ÏÊÜX.¸ ³dé X¨')WGX©SYTaÌÿ § 4§².ß91"on"]ÁX£4Øá £S@ôA¨6BÚ«Qvû<Ïø¬î-pDv+Øä±Bà(- ¸ xLè` ÷ãð· `)$Ð +:¾ï¨cFÀ¬ v ì·fCñ èêê¤JÊ( ½ à@çµê¸?åËø.-bãW¸½ÃPlNY\©sÙÃÎl+Ô¢L(àÆõYF> 'OT¸#óó÷5C¯àJ- ïD¯¼hý°Di ݱT >° _ïÊe<IõËù\V"= *D°VDoxle×jÝÌ´ÁHátßY }7\ÿ ~ñÏÅÿ ~? ó/RüÄ;q /ÑÁàNi9´îAêB4Ý$¿ ¡Õc & ¥ KÏ5Sév}Ø[Ícl ?£c-ÊD ð @P½l©2 ¡×@RUÍõÔÒS¨ ;«xÀS¿ÙMëûü/ã{ÔYX/ÕÁL¢]ù& m éÙ_ùø ,§ÎSçï.\¹* ¬SÃRÙ éZ k z>Õ l ~\nà=Âõý`=0C_ï4P P R7×ÿ ¼Dsôõo,' ¹Ì¾(GE .Øw}C F*«]qm,DÝÚÔPxá Zîu!ùÅYÃT_UåJ¢QhÞµEÁ ) 6b¨¦º:dpæ~¢¾ol1 «jlÏÓ5r¿¢ûÍôªÔºz]|O>_Åf-|( d{ RÇúTKÎ " Í¡Õ**bÒÝYý?éÉ´ z ª@ ¬à×ZÃT Þà.I jº*´ ID\Ø£¥ ýa6Ô=GÀU| ÁÑÍ{Mxc,ûñS*o×x4ÙkÒÜFËÓÀJ6éZjÛUÅ#è´@l¢}þVçÆ>Ñ\³ ¡ÿ ç{2PØM÷Ì*·erÒlJ¨íÔµÝ'Ïôäàt¥¡x[EÔalÇÒ_ÈWçÁ §Î#þ³¦\PÞÿ ÍÆ# @[ [fï°P*¨o"&FKµÒÛM »ÍúÕBé! ,¬=JSd%Ò°²Á! TòFÈŧ 7°¼RAFMhÀtOéÃÖPãvN ¢ÂE du k(¶,EHâpây}ÝÀdâÇáºÄ õù` ßrâßÃó8ì~Å1©ðMÿ GÆUÌY1} `pcyÆÜØ úTïZHB6»0qm@T ªúÕwAv<ÅL>_Åf-üÄà#îR?Y,Q«´w+¸ÑSÌ jÛ×ʺ4E^P:1C3ÅKbèÚÔwûXT$`*á±,dà¬IG!Ð]: ¡¥)Þ#3ÿ 0JYEoh¼nvp ª©°·ÖSzl=²VÛ* n¦ZÈ e Nã/\©èx¡c<¯íü¬ü-ãÔÄEÏÒÂJ$!vtM ¨då:6È(H *ÖRÂV½I©ÙbÃeÔ¥ÆFô§BKWȹH;¨Þ_£5þ3ïÞ <>~úb¿/ÏÇOÞôÉ:4á 9î%Í õ>å/Áê @@ C#TE,n C»Á%Â|QPW"`O³L¨CèR)R¯U+ ÁH RzÃ9ì$V a\ªÉóì!TRÀ,}5U½"SÍÅè:vORЦB! Q½öïþòå~Ãg£ Þ ½Ä%®Þ°¨!B¦ÕFéf/G!»>¬TBl¼-~LÕ>L P ôÑX¿1DP `Y°lÉ1c@_P¬ýW)üÅ®:?×Æ ó§ëÞAMæÏ aÒé³GD°m <>ÁÑ(¦Î¤6¿ Ü% `J© 7KÑùÅåiT7M iëÏYªD3nö'jqù#F4&ºQCHµM3ÐïPºøìß¡¤ºËGUÀTpPã¶ÀÅ®V/Ë|6 ?Fßë C¬þÏóõ\0¬& G5ÑPV* P4t¢ÿ ¤Ìy@ jÒºÀÃg¬ D-=Ì 2ªÍÐvÞåzÕò( 8ÆA*Ö®°EVå @±zw ; UM6×ð#ï'ï *÷ð¼üuü(ðDpoÞ° ©aWÀä]¥VÖêbUWF 6&DID X µðÈ q¥Sýâw ï[=!F%m¸ÎX`´SÇtÈ Ý C¬4 öf»»Þ$± ýGÀÍf þ± .Ï'÷½|ÇQ%(°S°+X'n¾ñ0ûj z ðFî÷eUÒllQé=7¤ÔÈ"0ÙüksË4èuF£g£º4izÞû k]è !âøF4G EÇoÞC¼Á¼þç4aà x ôÄu``W°ôÆâ`ì,DlôI!Ö0D2ÐÚB B;V -ãÄêe9®¢V ®Q>·uÆÔipd#EbtÀF4DÞù» MÒIõ ÁéEÒUÖ×´*´ áEH衱j¢:Å)ânÇSç µ }Ô:;; =ñÏÓ7Ìn.QC6¢I6iã9À£f¨Átu1 Eä.É) ¬ÁnÅE MÒ ¦!lm³é(>Âq5®¶]uhé #¡Ht4Q08T¢Ñôh rýf@ÂlÛ±mî=? Ð}Ãjó ïàg0yX«×ðÜWFÅyà h ¾W D`pNÄm'ÌDIðUùP+LoOÔ wXC¶úf¤®»;ÒÀ÷é¬%?øCFÄ>¼TòªÈò%÷b5ås[P¦Äßµ0 ÂZjøÄÆ ?°©h n¸M`½1~[G pÑKßûÇrfÚkëX«Ô*Db(8dø Ü)zpæ÷HàV¡ÑÅl>µ+ëè´Öi¬ ?¢gcöÀfªJøRê4Mäêj nÊ á 5"h i`¸}~î~ÀÅ>ÌàäK"¡ûe¾ßÏù~?éÂk&£Ç U³,×XlôbÌRWUOÚ¾¸l y0N \hhþRþ©.uöJ°Ð¾Hd£Æ%E«PîæWQ´ ÌÞþ ÀµphE_¥&Kg. ¥%/ÉM}8Ëbaá@þÜ :Îi¨ëKxUaª¯W n"6@'¦·ÒÎâKæj¤APØMÒu¸Hl0 ;*Ãè 5N1³@Ú$6 VJÄ£l}¸À·5ÊU0 éÃ|Á ¹ùÿ ¬XÉC cÛp¹=ÙûÁ8â¿ âÖ¸¯ë¬:?x4~óï"9 y. nB!ø ê¼»1eZ (h SiÐÒ¡Ù,pw* %Sk(> æZÝøÌ ÅT¦<xtë© XEÝSjéÒ?V@¼dÏúY£göfkíà ÒÄx)N%xÓYaq´º tèÞ«¦ÉÔR-éÑy±çÂX4w 5Ó ÞÍD 85³dù@X [ ÐY,í w ÐG¸½( ®fÜc§äɾÿ rꨱáuþqATcµ5g7¤èC 8 ¡ø»ª¥(Àì&ÜôX?L~&"ÞáH wï?Ha©ðÀ÷F OÌó. {t3×û|¸îÝ zíÿ 8¹z6èïM?Øxh¢æ #ѤS£µ@¼¨©U«¾¯qÈtì¼`%lpjÜ)Îãè¬4Ú?F0rGÀ;6GãNæ<=tÄ Iª:R ¨9TºÇ(@üA×¾cm§jJwEÐöÍ1þ2ÔVú_^M ¨Cè8_ϼPA<8³"T°HÆçJ ±@Ö§ÀRäbñ0o3ìÎ/« WÃõê7w" t*)\ ²/ø¨x~îPõâ68G>§x0|«óX_gã FÖ7Òa0¡AeÆcmËí_¬Úíà n @íØp¨-avZb¶Õ±!AØ?X=ON½Jàî0"Á ;NÄÓÏ.¹í4iÁ]:iAà oïæb¼R!zPCªKø?DTv+°jxéÜ£ {ó_£»ëCûÂoNî$³ ï{mÀ¹5ѼK¶+v)TúZë ×FD]\Nù·Â0¥ ¯Ð:¦-EÃF:É$òL Oyõ<Ågã>£6ÖT VíHË{?ó&óÜÐ:MAÒ¬3±Ü /kZÔȳNKfÌÙtßÞ<õ#é¨p¡¸ª~Quyÿ Xkõ×®ñ !N¶: ´¨+ aZÒkt˳p/zPÞÒRXÜ@{úUø2ëêêäõ=G½U¢Pów7§ÔF]¾HýÓ¶{Zÿ °«?x JÂ2°Ò+ ¦ ;i`1«¯YC¥¶ 1ó ;-C±4i! 4Bª´ UP]Ï19áþ`9g{Oð]Sö]åð¯eâ¶DÆÇPÔÝÉa¤0À¤dyjS» ôdÑÕn¡ K¯a мH&%© *ÿ ÚæúΠدgï:X«ë(FáþðwIZ¶ J¦À°ÀÄ|#©z ~±©¯1.4Û rbHgÔ#c¥ÄYA`i.#À£5.áï(;«>¶ qɧúDÔo)Âà§à@d ìg , ÒOÊAÎíÎPIÏð`|=A÷o ý`5v\}ݼ!_ Rn*h R@\é@ãZè/§n81( )â6ù%»¨-ø=>_:Ñ"ÅÙF¦© °mÆÆ9ÀT u¶X~¨N« SÛ¶6ËæR«RSX, 6 úU^)0[𵩽b,àµÃÂÍè N8s®Úèµãà(¼¡\AîÁÞM|Ü 04çÃ4ÏóÁ_5³ó·$i4¾d¸:64j&´` &¢åL ôÑLnèðÄæÙ:8DêzÆDBa¯wG0R©Ü#¹PjT¥UØÜDÌ TÙ®kì ¬îT/W p)Jªáah"ÅZóçë¬%ê×»oËmq4P!%© DÀC@ ÂFuvë`ß»åøÞ.Ì©ZD *×ý}ê¶2½Â<<eKUZ ôDøлÅÉóù*"ggxÝ)Ú èH½©NØó} » `©]5¥¬å¦=³,º¨. nÖëX% èpÇØ"àÃ:1ÚºDØâ²M/V¿³á´Ãm¸giäÏCû0ñÏ«5 c_¤iõíozßÀ 8b¯z0Ó³$%lc=éÍà¤]0¶1Èï®$²Ò/ ]mØ {? A-Ú)W«UUP4Ô=ä@P¢[H, û¹å£DaB!)Ûk)OÒVR»<bãô¡Öe¼´|¶à®n¨BƲ¯7¹<ää `&écܲ,Q£ºÈ{(Ô A]qà øENjµÕQÖȧ©WÅ^ ÖÛÐ £¦FpÜØMHÍl×g¼ÉBoÈvo@]Ϊh nîÅÍ¡A0 ÞÖ¢"SûÈá >¶õ5MBWrN¸@oT±Ý 'ô¢nÏSîòx?-ðW¸áQ¥,ý «à9¬Gö|àFbÛÞ`ÊYL¦ípP|8×ñ.Ë$( Ö*wöþó ëë}¼Á?·É .cª¬bSáÓèBÞìè ÂhkÓX6]JG k{Ôn3ZW/æ%I' Nã t ÀñÊ»°ú1D*Æ*Ð 6¡0&ÉÏÈÿ x )"µ²ßè0ü:øÆ~éƤW¨ÎY±FwÖ iôØ×âFUñyTy´ ]\h"'Îé7) ,¡ZBmäq\y kÔ?VdÖWUk@çÜ â¨$*Di[+ ( }1Ò%UÖð°"8è$U!V3ÆûT°]h+@'A:LãK×@©£UÁ!VhFDU²¬"©(í 4SEÁlÁ.ÛG^ ((:wÑÆ>çÐdBóþ²J'¯FHõmÚ5 f@» KÙ¢ 1¢I Uv«î4aè)ðdï\@ ^`T=ÔU1ÍÁ}¾4Ha ä±¹ k#§¡ ! ¤i Ö@pè,ÜU°"@ Ûè3P tÑpMÌ£Æ`g C,ob,éD×t)j¯ Áhðiùuc0S¢-mB;·£4ÍA¨XÊCø x ¨Q`¤Æùvº{þñý) ]_°%öß"_aGÇáh¨B1GäO» ñË?ÿÙ |
| URL | http://testphp.vulnweb.com/signup.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 296 bytes. |
GET http://testphp.vulnweb.com/signup.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/login.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6033 |
| Response Body - size: 6,033 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>signup</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h2 id="pageName">Signup new user</h2> <h4>Please do not enter real information here.</h4> <h4>If you press the submit button you will be transferred to asecured connection.</h4> <form name="form1" method="post" action="/secured/newuser.php"> <table border="0" cellspacing="1" cellpadding="4"> <tr><td valign="top">Username:</td><td><input type="text" name="uuname" style="width:200px"></td></tr> <tr><td valign="top">Password:</td><td><input type="password" name="upass" style="width:200px"></td></tr> <tr><td valign="top">Retype password:</td><td><input type="password" name="upass2" style="width:200px"></td></tr> <tr><td valign="top">Name:</td><td><input type="text" name="urname" style="width:200px"></td></tr> <tr><td valign="top">Credit card number:</td><td><input type="text" name="ucc" style="width:200px"></td></tr> <tr><td valign="top">E-Mail:</td><td><input type="text" name="uemail" style="width:200px"></td></tr> <tr><td valign="top">Phone number:</td><td><input type="text" name="uphone" style="width:200px"></td></tr> <tr><td valign="top">Address:</td><td><textarea wrap="soft" name="uaddress" rows="5" style="width:200px"></textarea></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="signup" name="signup"></td></tr> </table> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/userinfo.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 288 bytes. |
GET http://testphp.vulnweb.com/userinfo.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 429 bytes. |
HTTP/1.1 302 Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 Location: login.php X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14 |
| Response Body - size: 14 bytes. |
you must login
|
| URL | http://testphp.vulnweb.com/cart.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 372 bytes. |
POST http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/product.php?pic=1 content-length: 19 |
| Request Body - size: 19 bytes. |
price=500&addcart=1
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 373 bytes. |
POST http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/guestbook.php content-length: 33 |
| Request Body - size: 33 bytes. |
name=ZAP&text=&submit=add+message
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5393 |
| Response Body - size: 5,393 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong>ZAP</strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/search.php?test=query |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 367 bytes. |
POST http://testphp.vulnweb.com/search.php?test=query HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com content-length: 25 |
| Request Body - size: 25 bytes. |
searchFor=ZAP&goButton=go
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4772 |
| Response Body - size: 4,772 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>search</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>searched for: ZAP</h2></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/secured/newuser.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 376 bytes. |
POST http://testphp.vulnweb.com/secured/newuser.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/signup.php content-length: 96 |
| Request Body - size: 96 bytes. |
uuname=ZAP&upass=ZAP&upass2=ZAP&urname=ZAP&ucc=ZAP&uemail=ZAP&uphone=ZAP&uaddress=&signup=signup
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 733 |
| Response Body - size: 733 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html> <head> <title>add new user</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <link href="style.css" rel="stylesheet" type="text/css"> </head> <body> <div id="masthead"> <h1 id="siteName">ACUNETIX ART</h1> </div> <div id="content"> <p>You have been introduced to our database with the above informations:</p><ul><li>Username: ZAP</li><li>Password: ZAP</li><li>Name: ZAP</li><li>Address: </li><li>E-Mail: ZAP</li><li>Phone number: ZAP</li><li>Credit card: ZAP</li></ul><p>Now you can login from <a href='http://testphp.vulnweb.com/login.php'>here.</p></div> </body> </html> |
| URL | http://testphp.vulnweb.com/userinfo.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 |
| Request Header - size: 368 bytes. |
POST http://testphp.vulnweb.com/userinfo.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/login.php content-length: 18 |
| Request Body - size: 18 bytes. |
uname=ZAP&pass=ZAP
|
| Response Header - size: 429 bytes. |
HTTP/1.1 302 Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 Location: login.php X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14 |
| Response Body - size: 14 bytes. |
you must login
|
| Instances | 62 |
| Solution |
Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers.
|
| Reference |
https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework
https://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html |
| Tags |
OWASP_2021_A01
OWASP_2017_A03 WSTG-v42-INFO-08 CWE-497 |
| CWE Id | 497 |
| WASC Id | 13 |
| Plugin Id | 10037 |
|
Low |
Server Leaks Version Information via "Server" HTTP Response Header Field |
|---|---|
| Description |
The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
|
| URL | http://testphp.vulnweb.com |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 238 bytes. |
GET http://testphp.vulnweb.com HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:51:59 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/AJAX/index.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/AJAX/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4236 |
| Response Body - size: 4,236 bytes. |
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>ajax test</title> <link href="styles.css" rel="stylesheet" type="text/css" /> <script type="text/javascript"> var httpreq = null; function SetContent(XML) { var items = XML.getElementsByTagName('items').item(0).getElementsByTagName('item'); var inner = '<ul>'; for(i=0; i<items.length; i++){ inner = inner + '<li><a href="javascript:getInfo(\'' + items[i].attributes.item(0).value + '\', \'' + items[i].attributes.item(1).value + '\')">' + items[i].firstChild.nodeValue + '</a></li>'; } inner = inner + '</ul>' cd = document.getElementById('contentDiv'); cd.innerHTML = inner; id = document.getElementById('infoDiv'); id.innerHTML = ''; } function httpCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetContent(httpreq.responseXML); httpreq = null; } } function SetInfo(XML) { var ii = XML.getElementsByTagName('iteminfo').item(0); var inner = ''; inner = inner + '<p><strong>' + ii.getElementsByTagName('name').item(0).firstChild.nodeValue + '</strong></p>'; pict = ii.getElementsByTagName('picture'); if(pict.length>0){ inner = inner + '<img src="../showimage.php?file=' + pict.item(0).firstChild.nodeValue + '"/>'; } descs = ii.getElementsByTagName('description'); for (i=0; i<descs.length; i++){ inner = inner + '<p>' + descs.item(i).firstChild.nodeValue + '</p>'; } id = document.getElementById('infoDiv'); id.innerHTML = inner; } function httpInfoCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetInfo(httpreq.responseXML); httpreq = null; } } function loadSomething(what) { getHttpRequest(); httpreq.open('GET', what, true); httpreq.send(''); } function getInfo(where, which) { getHttpRequest(); httpreq.onreadystatechange = httpInfoCompleted; if (where=='infotitle'){ httpreq.open('POST', where+'.php', true); httpreq.setRequestHeader('content-type', 'application/x-www-form-urlencoded'); httpreq.send('id='+which); } else { httpreq.open('GET', where+'.php?id='+which, true); httpreq.send(''); } } function xmlCompleted () { if (httpreq.readyState==4 && httpreq.status==200) { xd = document.getElementById('xmlDiv'); xd.innerHTML = httpreq.responseText; httpreq = null; } } function sendXML () { getHttpRequest(); httpreq.onreadystatechange = xmlCompleted; httpreq.open('POST', 'showxml.php'); httpreq.setRequestHeader('content-type', 'text/xml'); httpreq.send('<xml><node name="nodename1">nodetext1</node><node name="nodename2">nodetext2</node></xml>'); } function getHttpRequest() { // free the curent one if (httpreq!=null){ httpreq.abort(); httpreq = null; } if( window.XMLHttpRequest ) { httpreq = new XMLHttpRequest(); if (httpreq.overrideMimeType) { httpreq.overrideMimeType('text/xml'); } } else if(ActiveXObject) { httpreq = new ActiveXObject("Msxml2.XMLHTTP"); } httpreq.onreadystatechange = httpCompleted; } function SetMyCookie() { document.cookie = "mycookie=3"; alert('A cookie was set by JavaScript.'); } </script> </head> <body> <table border="0" cellpadding="3" width="500" align="center"> <tr> <td class="bordered"> <a href="javascript:loadSomething('artists.php');">artists</a> | <a href="javascript:loadSomething('categories.php');">categories</a> | <a href="#" onclick="loadSomething('titles.php')">titles</a> | <a href="#" onclick="sendXML()">send xml</a> | <a href="#" onclick="SetMyCookie()">setcookie</a> </td> </tr> <tr> <td> <div id="contentDiv"> </div> </td> </tr> <tr> <td> <div id="infoDiv"> </div> </td> </tr> <tr> <td> <div id="xmlDiv"> </div> </td> </tr> </table> </body> </html> |
| URL | http://testphp.vulnweb.com/AJAX/styles.css |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 306 bytes. |
GET http://testphp.vulnweb.com/AJAX/styles.css HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/AJAX/index.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 341 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/css Content-Length: 562 Last-Modified: Wed, 11 May 2011 10:27:48 GMT ETag: "4dca64a4-232" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 562 bytes. |
body {
font-family: Verdana, Geneva, Arial, helvetica, sans-serif; } td { font-family: Verdana, Geneva, Arial, helvetica, sans-serif; } th { font-family: Verdana, Geneva, Arial, helvetica, sans-serif; } a { text-decoration: none; color:#333333; } a:hover { background-color: #FFEE00; } td.bordered { border: 1px solid #CCCCCC; background:#FFCC00; } #contentDiv { border: 1px solid #CCCCCC; } #xmlDiv { font-family: "Courier New", Courier, mono; font-size: 12px; color: #33CC00; background-color: #000000; } |
| URL | http://testphp.vulnweb.com/artists.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/artists.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5328 |
| Response Body - size: 5,328 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class='story'><a href='artists.php?artist=1'><h3>r4w8173</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=2'><h3>Blad3</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=3'><h3>lyzae</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6251 |
| Response Body - size: 6,251 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: r4w8173</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=1'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: Blad3</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=2'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: lyzae</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=3'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 284 bytes. |
GET http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/categories.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/categories.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6115 |
| Response Body - size: 6,115 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture categories</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">categories</h2> <div class='story'><a href='listproducts.php?cat=1'><h3>Posters</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=2'><h3>Paintings</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=3'><h3>Stickers</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=4'><h3>Graffity</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/disclaimer.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/disclaimer.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5524 |
| Response Body - size: 5,524 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>disclaimer</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">Disclaimer</h2> <div class="story"> <h6>Please read carefully</h6> <p>This website is created to demonstrate the abilities of Acunetix new product <strong>WEB Vulnerability Scanner</strong>.</p> It is not intended to be a real online shop. Also this website was constructed with common web programming errors so it is buggy. <p>Please do not post any confidential information on this site. Do not give any creditcard number or real address, nor e-mail or website addresses.</p> <p>Information you post on this site are by no means private nor protected!</p> <p>All images on this site were generated with fre software <a href="http://www.eclectasy.com/Fractal-Explorer/index.html" target="_blank"> <strong>Fractal Explorer</strong></a>.</p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/Flash/add.swf |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/Flash/add.swf HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 365 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: application/x-shockwave-flash Content-Length: 17418 Last-Modified: Wed, 11 May 2011 10:27:45 GMT ETag: "4dca64a1-440a" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 17,418 bytes. |
FWS
D h ¸ 2 CÿÿÿÄ ÿÙÿØÿØÿà JFIF d d ÿì Ducky < ÿî Adobe dÀ ÿÛ ÿÀ B k ÿÄ !1A"2Qaq3B4RCðÁñbrÂ#5 !1AaQÁ"2ðq¡±ÑRáñBr#34ÿÚ ? äRp«Ãáð£$GÓ4M´ÞY¼Ï¶AúEíð¯_eBk39<E~wN>S lï*³6º¿[jmÔô®è÷±$°=¨î'~Ìé´r=¹Ác<mÈçbÀ|Ë©¸éo/×áQ'GE o-ÊæO<ñ»³6ê ÞâÆÀØxR@ ¬J"¤ µ4#x£i Q}Ll5¯Ö¶1Ûâ¸5\®Jï `ÙÊóz|×ðªsÂ+â$ÜÎ^Osñ6ÆÐS»i&;ZìÇRõʬÂ3Ó,kõåÈuÀPä½ç˾;c ®¬²-{±7 ËkÛJëV"i-y¹³æJ%áB Bè [©ùÑ$jÎ aóç| ÅFÜÊBdª¨ ·î¹ÆÈ<¨´ $°ý~¶¥;)º¦Ó Føì 8æA w#$àoRä("àÛÆý-Ò°Æ¥Ã*ó {É8¢L|`5/iñ õotBÚBlV4¤ÖÕ̵*è´"Î+3LªÍk7 +dMöÿ #qá&\3ãN ÆEÔNå#qÐá¿qE©´ðÃ/dRBï¹½®°&Ç<) y¤oµo©í^®7ÉÑÐG jÐjXÇ/hq¿ 6~XW ® dBý'ÆÙÒfÄáîiÏ6Ùý¯§h SÔ ¨ÛJ:@a.Ü °í9bK H7oùÖ U·¬F.7·cÈxÏäwDqu+oW×é[ëïSI!x±=».^dE!qÙM[[êÿ :iÏJè MÀ )#r¥XuS¡i-M px8¹sÈÉ\ao#0$HÚKP: ÇHp ¤±m«4ø¥c`LlÐ8¸¯Ô^ªF²ZÏ/Q¤ êás³\~7Ù»Ý ¡²ÞÇ[W£fô^²Ï'B¾ ÛOvyí? Tk)cxVue`N¾J×=¶0÷1ʾ"âqRìÅWef ÿ H¤îVÿ Nº[OãZEñb÷nN´õ ÓÀ'²reiò¦·ãâÄv°`Ö%ζ饺Ñ''äËÆrY t2db®á lË%e$þ¢|·5çÍÎÌ £Þ¯Æ2)Qó8ùùnl ¬éÿ ¯ÕµÛ`nÖ½c±ÞÖO[Xñáî¯ó ¢UÌö¶2çãO?(H {nÐØ ~Ûç÷ZXÍÖÝíÖMÿ rdþft¨ªÄ! è7×¥uÆ)!»FõTháÊIcîƬ G{>¤Ö:/·ùLçXÄ,5 ²°®¼5æîí(A´ûùªòƨ¼@üûrØnP¼íëbM>]Ä~ªí¶á<U"ÑîbN¤ØG`üèr¼n WSuaÔà¨Y$ßÆ´Ô#/MH ãwGVBU¬4 Ö,GBöäðü|Ù/åIgÃkÄ£¡ññÐÖ7Q^ #E¯oryü¿";±»ë´í:[ëNöptKøÅâùdÆÏ~ÉVnÓ`àGJÇʵZæ»GZæOc%d¹ß2âØ¡-ãükG¼M× @´³=§Ù®1ãã°H÷7¦4'Ô|/m/[y©.öx!P¥Ät>{:<Äw7B 4¬éêð*¤\Zÿ 1^_©©¸5 xýù@ÏxÇ >x48æ÷fÛ¬ú ¯O£´áLðÇ´SbRá/BMµé^ßøvnÛ^ µ»vñèÝ~çÓ¹¿wyÓ¯ ,çÌQhDÕ!*âÀ·?%:$rHY# FºY@l?bÄà½Åvó% ´nX«\ Ûám5¢pÔÕr Jø<¯k-gÀnüíW%ULtN;LÎ%eÈ [ã ±»lò)Ý´m: ÿ :ñ÷Îj)âño ke©y>Ö[6Ê°d ¬ðÃAqáNÙJÚW ~-·^1çÌm× o³Ñ¹êê7ocàT\)ö5Õ·õ(\}¸Pmã¤9éÝX¹ÓÄèß);RÑ£cÜ°G3ÂcÛ»¶¡Ê®ÝmòÒ°ô½^Jmסæ9æWÄöÄ]òre# .ÂÍ{ «þ«ÑºõÙ0öèÁ°¿ühm·{ôö¯ó^Ý:V_ rÃ>¯ÕñÀ`ª@MR´#aZ¦¬Noô«_ÊQ % ûjz ô¥¥ 19&aËiuÍÝÖ¥[° þì3"ÆÉå/v æÓK ¯;ñpUqÂTÁ®JÖ¸Í:ä ¹äѵµðS¥þÇ5{mi©µ8?QJ¹8øèÁå +0 µ ¿ßXm'~vT-ªS2¤xßÅìfW ªK2ùYÒÍ¢jæQ] ÇY× íäN°oü ~Ñ7z7n>åéÓo·üL>^ß?±:ÙÈêeR5hD´U 6X£'Ãh"ì(o@ø '29+ïdýD|@ùTNâ +ÅÐi | ò²GknÓ®k\[ýï°ñ2¡²dÇÀPB5]êÄ ñ6¶ÃfÔ÷W|É?ñðJm%Cc Øf\¹BA`- !õ[AXî%ûKúâë«ÒÔ¨Åîohr6E¹ÕÖ¹ø öö» v Hͪ:ÿ .öí5û¾×kíúÖúI"yæÕ¡*ÄH«@HëVl:Öx?ø²þ×Ñ£ïz_ñ¨^.<{ óâÚõ¹öÿ êùUÏ'îõÃý¦û rOO§¨ôü«uÏ8}~½%Ä/û?ét ÷Wμ¿Yñÿ W ü=EÛ{÷cîu>®|?ƽ?Lÿ Zðõvs2Ï·>Ñé×ú¿k§êþÝ/\~»J´NwÞýïzºkVö?ò?w Å/[ú£÷ßöRáÿ ßn±}ÏÿÙ¿ ' h ¸ A Ù@ ¨\)G²ô5±Ø Î( ÿ @ i @ ?> ÿØÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÙ¿ ÿØÿà JFIF ÿÀ B l" ÿÚ ? öúF@ßÃíKJµóÒòVKTeÛµvÕXtø-£Ùiz*ñÅjTrV&Vå1ï,b¹ÛçƯ±·.ïQXz çê s#nH×÷i·2Oò®²Eùª6ÿ ã´Âé k[¨î6JÜI2¹Ú·c= à<}a4ë4v¶¿e¸¼ ø \ýÀ»¹'þÒ½¶e 5bêZ}µÎç¶÷²òªØÈ°8!>WsHUå1ã¾X®d²³Ö®Y®£ lDF>T¿6á(#¯Óýî1õ«9µ[rÍÇxÿ Ãw³NìÒÇ@ª?\dz|§£sËð ȳ}:ææy/m[ ¦ ,Ý÷¹ÉËu'js[ö6«R¤wìzL×8Ùݶ¨êzVk)s}{k÷~Ìá>VÎàȧv8Ç'§ãX>)ñ ¿=Q]E°IGæ 7d O\/5æ~ÔukýBêÉ/- 7!IYÀãÉñü>µPù'&ì°®Ps±Úk^4´mN%uŲï=ÀxÉàò1µ³í:×?iâ fæÖ¢Ñf ï Ç$ ú×M¢xßNÕgÔMþjðÄýà3'¹Ýþ úw¶ ¥ñeÇú«2ëÈÏiõõ8éT¥Iirý¥%¤c3ß©i)k)ÊAQÌÔæ; õ®jÿ a¼±ÆÌn ¡;x@Iü1YHÒf S©¾peÏçøU RìÁo#¬m+ùf}êCÈíqÊÒÛs#`ýkÄÄzeMò» 9 OÝnäçûªsÿ ë®R v1â-ñÉ"ÁyÏ$R².Ü ïædäjç|csqâØ®à´ÝkclÁÍän¿yxï /s[B¼¯±Ñ ^òçØé¼Oâ«M-müé1çgiÇçÎ:÷®ùu©5XuíMYZܺGæHÊÝ ±8H×'¿=+¯ð ¥Xv$ûB3owÚA,í¼ÏÐ »ã 2Þ}*H¥¹ÍîóRM sØÀ=zVa.XësHJ¥Ë nPм+ekr÷4³Ê4²¶KNݸ_øp[3M<{fIæe,ªk1=²0xïÏ·JÂøy¬ÛÃ¥XiÓùþr-˶U1LoÎXaTdóé^ nZί<[LÆ·<esä·Ãí;Ks´×êZÄ`9PÎì¤ã¾úýpx¯Xhw/÷k.OÛ;³JnYØä)ééÒ¢3²±HZuqzWtÙ¼¹Í,1æ+yß(?& Î3Ïqצ uKp$]ËÞêo©4±~õqZÅÎâ=.ê [¤Æc/¼N9ÆAáô5¿¬]½µÓE Lè¹òÑ[é~¦¼Äú¦îÖÞûIÕ¥c&RelbS°®í«s³Üuªpæ*9ßê %¥ÒOñË»?3Hp Ü@çÿ {-»5 õë¯,å[¹|N-·³Ñ6Üw=;uÀxkÄnÔõdÒYRîêPåånmE-× Ü=þíwð woª^/©l cîi>| -«ó +ICó3IÁSÏ:ºÐneñ<Ë"©5XªóÙ9|_N6ÿ v½OÃ62ùwÞYÁåÎG>T»6ûñ·ÜD «ItÍòIÃr2Ïüæ¶-l¢´µ#Ùjx p°©W%bg_Y|«÷vûÖ4mJݱ£K±Ò9:2ëµ±éÚºÉÿ Í\F½¼· ðÜتK#±YHùTüÇ¡<×ÐVqõ3{uá-×Kñ ökök¸z ¡È ¨X ëÛo¸ÇZök6 ¸ÝÒ¼'VñCÙxÚxWÌâ#2Bì]B°ï2 sÐf½3ÀwOåÇ Ùu½K½ÍÆâIç®F{ qþÍtW²:1J£;¨×wûµ&ÑN>]µ6Ñ\§)çßgð×U-®îë/1E%ÉBØNM¿»Û[Ñ$*ÿ w=ð¯-ñ^¾ºeuo$ðMÜ m»*L² ùO9}cÄãOµò-¶Ü_yEÄ+÷¶â>§¶^Ó¦åcgVñM½µ÷»ý $-)ÚÛ³W`ÇÎÍÓ¿ zrÖú¯nd{OÒ¡ÜÒÚ Òví#æLc¯iáYµ=_KÕnâ¹Gºig;6ÀmÙÝ´«çiàäú õ(tÁ nù Y:~¦jå;Røw<OHðŲYÚÞÇeæ=Ä8F\ 6ÖP \æåxÇjô øp[-C@½ì2 A.é«Í'Ìwo#×òè_fµ¾¶»o´Dn¤u- ~ê÷ søôãÖizt6qÛ[F©|*/G ¢u\ºë9u [U²®l5&ï÷«£2µ«XÁ{ÉÕ]CgÓ OR¶³º·y<§¸ßånS*Û»¦psçô5ÍÉâ;9u;«Xäÿ uRÒ3 ¹lü çï ÷ W+ì ¡ç'ÐZ-FÊk¢ºin±p7,a"*Ë·áÜyÝÛæùzï h2é±Ô'ÎCo+¨2>ç ( ÿ ëÖıÞÚXj¿o.h6nkºòqΠºK=Z +H îî%bZ<Èüpü«iÉò$tNs;º«V6Ö^|/|ÅòÚ&NθÜLÚ À®sÇÍ^3×Ç J»Z v(ÊH¹Nq]'IVÔÚsæ0_Å8çß(®É|(îÂY²âLîQÍlAË(<J(®7ñ +r{pP Óð«4QB% QIü4QAG=âø£LXæE9 Xd0*sÞ¼ðÔuä` .«=ýªUÆ=6¢¢¨ì(¢ºèìÎÌ6Ìд&çJ»[e_¶¸ÃüÃsëô{F;ß ]Gy\FjÊ¡Âî ôÈàúÑE.£[ͦÿ «_úèGà«EÊq½ÏÿÙ¿ ' h ¸ A Ù@ ¨\)G²ô5±Ø Î( ÿ @ ?v ]ºG·" ÿ 2 e K ² Ë å @OÜS!! /r«é¯¦½C£ ä¨SQ _^àyíY²0@*¹jÀHwÓ!^¯ ò+és©#©ëÈó¡ ,ò«ép&Á@§ ä¨SS `àg½ò¢MUËP¦ §@Áÿh_Lª |uáÔòÃ. (ò«éqÎfÆ9°ä¨SWÿããå»Çn]É´rÀ-ùjÀçXó ã¨r+é Ìs¥©Ö¦33 HåWÓ $fMgrÉP¦· ÍÍË6pß-BàÏ6c<ÔE}2 vʨ:Ø cc`ÎU}0fQ¼ÙFÖ k0 ¬¬ö¬Ú |µ oûC|©²S@yôÈeÖ¡ÔßÆ19ÐiV ÿ_Jý5²Ó[%BÿOO-N4å¯PNZ (+iÌ[¦È¯¥xZw¦þ?RùUô ÖU-eQrT)b ¯[-Ô¶ì ËP¥UyTÖx_Jßú¹USq#PÊ0üªú_íí'Êi@y*²Ùµ/ ËrÐ µ PSÚ=à9ô %GåT N|^Ñ1y'*¾DÂló ÐJ 5à|^[ÀBå¨SÞèLa ȯ¥{ýré8ëEß_L «{6å`%B¨=í6n0-B¬ócÌ5` E}2Ñ®Wy @?ì TtßH àÌvÿ²a²Ô| «ZÿÿàÌvÿ³»%à¥ä rBÿÿ«Zÿÿ«Zÿ²^1ÐÓ «ZÿÿàÌvÿ 0 ¸òyÑ©WèǪÖW â oलKCýäb ,ã83YÑ« +ÖZlø@åÃÀÄ8TIÅ£hÄ¢¼-d ×±Ú:¥|p_K²Kþ;©h¤·PÉY% õìvx´ å,ÂË.ø@ ±T Kù@ «ZÿÿàÌvÿ G]iॻÿ9s æ3&e2a TÌèÆpxa©@]Ñ\ùî| ÿÿÿM ÿÿÿ3VFáy´UÎi!ÙLFæÒËi@úASùz)"uËÁ)æSRf»}sÛtÂ;Ëò×òþåáói«2Ac/},cÇÔ¹Ì Fjñàß ÿÿÿÿ ÿÿÿM «Zÿ GUháùVt,_9¤¥õ u®nl_-0à:{1õ|>:% ø!¬Ëb>K>i¸AUW`vl³Â2 IxãVD¬8¬÷F £ÙOÐÏò¦Y· Ò ÿÿÿ& ÿÿÿM J:ðÚo¢;Å1¬ þ6yÖ©l/RÑá\ù%Ò©ÇR¿ Ótø Xex,T!âIkV·×ãr:® ÏI Êø@ ÿÿÿ& ÿÿÿM Smbáý7OÉ¥WÈeH" $µkp9 ~7#ªâ øôéL£ªtªMôGx¦2ÆÏ5ºÕ-eêZ<" Ë$ºU;á ÿÿÿ& ÿÿÿM UöÚhF8¦7 ¿Ò?Q³Ö¶´Ô²Ñ¡ ^_I4nuURÁ Ó:X<^ hyWk[WøÜv5¬ÏäI£²® ? Á Arial _ À  â `¾g{ªÛ:[iwós÷! 9ßp·Ñí j ° 3 û 6 µ Õ ã E X £ [äGæþEe¥×û 5F]w4ðSµïvµÐ(6Ý;¢ 0¼ûCcË 0ª¹2r 'JWÉ>n×v 7T|~fR0(\ ÙØhÙfØ BDOßçºlÄl3ì¼oô£5$£º'ßçºlÄl3ì¼oô#5% í÷å{6» {Ä´½ËÆÍ®â_x²U°¿¨ÖÜOoʶ7õÛ û){[ûk]Ä^Ê^åQ«±k¼W+ܱïêµv-AQsvî'w©{-ýµ¨ /óWfkß}n¹jêÅ>n »«]ó¤ JPÜ7 ²{F¿-]kK¢¨ S P"bÌ]°³ï«WQ®ª¹ÁËæ;1 UÛF /yòK%Nü( Õ¡¹U6nSF¥r@ æ ]Ä?úeoRX+ õZY1" ¥ ¸ÑùM zOv OV¾QYå?F)º8úxQ `òéæ ²'É£%,dPÓL@& ]Ó2HÊôkÐ Lùµ3'0@V6*¬·Àj;7HèlÀâã²8¨Ç0·À=<êÇx [!¾fF~l$óÎ bØ¡n©0>TÅ)`"ÌZb Á0îÚFW ^jgÍ©9µgµ¥¼QÙºG@f F ±Ô %F ¶9 ¸À,æ ¹êäN;à0@ O?Uef ¤ /&Ê ³ð³*bÌ}igGáv]÷ _øÓBcLôà À ¦0. @ iº·¡ò¨66ÕÑIº5Ϧ3C@.Û6Vî5æ ²WWIfP´iF %¶Ayt @%9I%u¨^ í}ng5¹g9,¹K(LF`* óʯ9« B$Oßé»ìÂì3ì½ïô"u$ /ÆkZ,Ø)ù æ`y9`W ö7ìq"÷%ÍÖ¼ ½8âxl` 'öÇbþt´@ªnû^+½úûV ËÏ¥¯ó6;Î CóOÓf?[/` `ÕvÜÌ 8H)7µ0öÂFßWÉùú¶£Í+0øѺ&¸æãØÙ¼m \Z³ \ôí äÁ HÝîN6k7³ ]ÖFã eSrsºÉØ« ` }i@9Ø]ª×ÔæmФР"'fÙZà» }m oÕ¡[ ùböØ· A]/~ ìf°5Õ×U@W`i«f ,AE ¶pÊO?,²l²» ¥0í'Üi ,ô¼à ¬y*§Jø¨¸ dà _[-h°@K¶ôH`® Kðئå¸rß?0ü²ÏÖ ³S2^éÎl®'¡¨ëp hÕvU¸!¹àRSЧA7gyâ¬yUG6P\Õ¸@&¿ Ù'dm ´ÁS'ÙS d´ LÔ zw1ñм nU.åuͬ_>¥¶as]¦< @ "¹ÿjפ ¤R¥DدÀ,©1f ü !W±-ð@k+hUwW@bv ¥:ö oßY`.¡tÙ m7Â4ÇYÓ ç+Jð#R³4md¦e(ùÓË<âó LH^ 0Ò ×HR P `cÍïK JXݨðX[5¼Tøa' ÛØcÙSØÝWìS¥.þá¸ãjVã "ºj÷ÄÁh¤Är¦FØÈ ¹óçWÌg«§6®¥Ðµ ])-Ò{m¬õâ#Ðü fÊ·¹¿°Å I$f $9f cÆIåfiÀ °r=èð@ gúëöÓËÒ^ܳ(µ@`1-Sú MÎwþÝ*ëôJ¿C0- !L~ Ó0/ä¸Ì?6aðÒ 5³îu à a;?2-c ÊÀ3«`¥ âå(©yRNW Ò§HÆ` M}IlTX`+,T° `ÆÁöj¸ i®¯ 'ÝûH9¹W>[v(æª ö:cÈä[. d E¬çF¼¶¥Ëh¹,²¦9É` èâc³ @3Ê\©e XÆb3I¯P&¾@ P÷këð .I4&$ÏCïÁX£»Rh ¨P¶+@pJø zô·¯M,ÀËyØ )CKe II$HRT «Zbp /õufÔÖ¿ Ê¥¬¨ü #¿j¿Ä¢Þ7)ó J¨ý²ÚS¥0(Ù@$hÝ.UtMËDÜ R`ßM|)0äÈ7`$ ÌvL>8| CÎ FxJq)âÍY^5PVÙ: µX *ja9,õô¥N0 b ¨Æm3éË%Tð _ SVb@ , Bì©ÙØfÙgØ 3[ Û,Û@ BÜ©ÙØgÙgØ `3[ û,Òs± »T'¯=© ÌÚ% -I AÅÙ¬âóf{+<gò{Pl¬ñ³ hw(ø!ÍÎeP¡ÞaÁlÖp<* h{`xÃF~Í?`ã?ì[4ü^c7eP .ÊgFY@K fBãb=¨82¯®;<Pr^̵ìD,pRM´Iè¶Ö`Ù£ìr&k @: ìNP 5(¤¦üë\g2f,KèÇöÛ ¥Î ÙØfÙfØ i×å¾Áyl®Z+f¶lÒ¦åÊ ¿Ä¦ÂbÍ^ØrU`9s«¶Ùì,ñîý¾)Ñ«TjS)° ðÌs°C{1 èÄÀºÖójÜUêMW«44Xù¼ÓæÙlóe³ :Ì ôj³1ªÃ)\Ì¥O@ À¤Ë ; ræi ¼ØFÕdUD M"EÇ5%ö<×ØÛöÓkPIÌ e#8öòpÜNpÜ( > 1ÌÆdrË1°4àhá5+, ·kí%ZílgìX *TòyH ¥BP ûå?¼åùN_%:RS@Mój[Öç %ÈC*Is$àÒ^ À+Á YæFi ÃO2X·v$wêä\ný{bdVãç~Îk6í'~$ÞHüè»õíp ` ZGĄ̀ f/+2ÇWJqpr_L¹M32¡!|Ä àg©lº`1.m àºQY+î'ö®|J©<ÒÎÌ .nÉ.üûmöܶî·AJ³U¸·Ú ù* EùH¶GÍ(ì .ʾ¼RëÃo¤Û~@m×à ikö°ÍÄïb5üpÑ Ú[gìÒͳH/0qe\ÅJ:(j0LÜ q2YÀó.Úy¹ì3öæÐܶ ° ¢lrIºQ f ] Fmäc¢40 @tf8Ñ£Á à ZG¸ýÞÊürÔÓ ¦Ì8 Å0j Ý EráUpÄ· M¶(3÷+ Vâvd¯)Tó1TwÆO¶`ݼ9mB®m Ë7*0 ZGȶUø$ý×-²Á5n¾¸ -nKº ZGÀ÷ì«ðN[®>ce[¨áSv'À M5ÃÙªâÿü(×6³ZØ M(Q¥5FLÚu JÒLYF©§2¦pÉà#S LJ\&¶ b^3àF [e§¶@ ¯3Å% Sq!à¢nD@ù¦!BA $Wà hæù7o @ ZG°ÃÂð/¼6Ã*ÝØá©ø(>gb| ZG°ÃÊ·v'À !éj¿¤Àò>Ä©@á#w ¢±Ãì0ð¾ .uK¥Sh ßM>6nH ` ZG°Ã¶q[)MÄ'1)â ¶7ݶ!×uý±> ` ZG°ÃÊ¡ønØ ZG¸æ+>Ò6ݤñ\Jø qÊ·v(¹lß>Vv*yòË!Ê6( À ZG°ÉÌÀ¤[°»Ê·v'9çûÊ6(À A7J1fg1f` @fQ0+W\º`ý5´Ö+K¦®- d»:jüíjµª'ð@TKS³rlÈé6#ÙÎGÙ.S Sñ^ÍÃ{¹66Ý¸Ó ÈóíÀ6 à ZGÀío°¦¥HdºÙK. Ú`ìDø¤ rÂlO¢ÂÜ_L¼ O»1Fè )iÁ.öºí¦úÜ¢p À iïÙfC.9ÛÈ5%ÕåÓ NWèM_¡©S6¥HÀeóS©iL£¢È30ÊFjó+ 6Ì ·Ê7"FI¶ \ÚeAsrùÊ» ` ~+鸯q·&ÅÛ¸ Lå*}Á( #&GMn Û%¥w=¢÷@ ZGÀ¢ÌÄ f)+2J} 'fMk, *rE J©:g{Ð }mùûFÛ©½sç맳\¯» *.Äø*,¦}ÆÈ`¾R¦äO¥1 ¹( ¯Íµ½^¹Ýy "è¯jçÄ¡G)lJȳภ«|ªøÇ)L`/JöÌÒìÍK~û÷ri¾~©feÍ^\ÕÀN%?Aîy9Ò&R >ñ¤Læ!3AÛF7ÅÖ®ìÚ»`T lËa ²PpÌÃNãs; L<<[)õ ÊÝæßgìØ#¶@N ^ñÍ{ǵ6Î/õ¾ HPå¯[íD²¯¹åPÛà hÂöxZ¹ÐfçA¿)ü¦Xi íɯ÷y/fä¼ á6xZye"µaU|f°í żðÛY Iç¹) ÃO1| v¼m'æ1¯^à =·v'@ ,ð>¤{ |Gx}-¼CxâEÂ;¼FÎqB("zÞ%°q â |ÝnìQóì·KoMVÞµn}lN (ÝǨv 7¡WNÖ¶VïIÏv¸ßÊ×YØã£ßzðO×u¾úCÿb0 HðᲸܲÎöôwjSæò ÿz:Q°ãÆÜiøSmð ÊÙ¦â»Å{S*x&}D²¯Æe5ÓiÀêl«r[Ð $fg+î1¶Rö%9XÃfÊ^äè -Po+¡[ <Æ¢öظ -¦gru³k°ÙË;v%6mwÜ®¤ CÅOØ£âXÎ K&Cb kqâ ?gfÿ*l òZÀ c¦Õö-÷ãnÈÀ L÷rªD¥¤FX ª 4u¦ÑÕ ½X%%îÉNmIÛj;fÚ4ÊN}3nñ^ K"Òá-ÉÎÚIFG7zSZmÓµd@± U(fR%Ú §²ñ0è1¡P=±E/,-੽¦ÏÛb%%%h¦HpĦÌ4+@ tÊ£I;2Â.ð )pb³ì-p Ó Ü,JÄ«(u$§g)@ N Do s^¥PMDe² kÎ`ñ¢¹R@%v\Ùó@&¦ ×Ï´èÀ%«IµLÀp@ Lö}Ú²7æ)¤Øu I_\ϽÜ/s UßÌ9wÁ1Öú Êàå¨m©¬9eÁ ¯ 5LfÖ1 i¬¤Æb ZGbMðÜ LàÙ½9>xl ½ÙeÝÇ n, é,Fïæ¿5Þ×uV 1Bè8o ®U»±X Þ`b³9U²tW`P§@v` =lÙkMX,1`ħ M~«Úº7R)lØ ´E^\Ï¼Ü /Ó/D]´È¶ÍÀ5 "$ÎC$ ,pN«ÌZ\+ óJ1Hø *",N¢o«ÞMéµs/ %²©µJ°@ ÏbÇfëa?VD % Í(Û¨uÊS°Uvù§kîZà7y 5Xì3ì£lLð¹»À ìÖv¬ÊIR¢2è¯"Ï*,ã)ÌÊQ6*-@Ò@3bXILh90Ýù®ìƨÀ/ ¦làl)ð¹s >sK¤ÓdX MB«6.¨V ë¶` U0|WÀP«@j` ý\éjÏX+1XÀ ZG°µÂÌnÀ+° ÌJ°¹53 'pªÜ5À|RãÃ(¶ ]+-ÒRKÅü)Å0 aÅöf6¶Z6)B -íØZåB{À aÆveö¶Zv)OE´FÓZ°ò6×LÚoËt¶¹QÀ \äóoZm¹öÁ ZG°µÂÑojÊ6 wÍX¼Mõ;bG£xíÀ=ÝilS @ ZG°µÊ·v) [Û°¡²)*´J§CP» Ì©Y1ý(Éàe -ðü5 %wÑ&ôSãÈm4Ûd \)¦Å7 O(±K«àÚ¤¸ qO70O '±L [Û°£²1ÕCx¬ (%*%JPàÛAV8TmnöP{eYfÂ\»î 0 éfÖ$ fáH¶) Aïl)nfEÅb ¸"ddéøNåÂê2±H.& »¹w¸ ^°@T?Þó 3ÌZd2nlÅ NêgM§z5èÚ` Ø $Fgì)l¢ÊvÂM¥ÖÐÈs L6 0ÜH9$rÈE´À]Û-ͺqð {À¨¾¦ f*1K`%x\éó@%f ÖÍ´èÀ%£i´Í@ð@ L±á¿%ÖvÙImªj ËY÷{@ö` Ì NAk~Vß áOfçaGoìS¢õ¬ÎUlÞ ÈT&)Ï [W.Z¢( ¦×2 iÁ ` [Û°£²£)øæ·Jkr ¼îÞIoì¾HÀ¡))KgåâÀ[b " jÏ¡Ú£;*#@JøìòÎôC5óvú[öÍ;ϵÝ-ÛpK²ø 2ºCBåâ®ÔßY_^JUä±ñ,öÔKê¾=2ãÓ0°e+$Ê ä"YÒzäíPÞ JSò>t æQ.UËK8¬ L ejÍ«ãY HGaÚ¶ð"Yà2ñ\5o^p þ;bûfëa vûµk+us°µ²±MÂÊ0Qqk< ÓýÁ M Ù² jTZ ,n¾íeÙÅ}æ·ØZáIæ FJ3ee8Q@ TG®TÇÝ;póãØZåB{ -p6½» üG$ûi^Ò)¾#µy°¹Ï¡=À *`]½» ¼ETÏhûÑÉ."¥°»ÄOM6³m â-Ù» úÒØ¢ãÖX[zé¸ò¬ÆÅ ¨ vo¦@v v¨¾ëJïZÛV`¶7Ò \LdgbG~N·¯ M÷VÄ $ooµ^¶b5°í¥é6Þé"®|Þöl0ñM¤ïrZ/ÆÊØZçÍäÜ Ä2èY¬¸JÕ®7\ ÊÙ·â©OfÀ÷$û6ü «Î7 £®CÝ®_]Þ¨ @í7ó;e1°EÙ7+6ÉJ°Ìò2XÈ.q÷½6S³#,ÀÉÍÞ& 8úKݶ³²ê;D´Ëa0Éx^Ð'IB" :RX Ì~Ê~n~%ÁÓ^yuæõboúi)¾7eñ{FÉsìµÿf¸ %æÇ ì'ò¼ IÍÙRÐ %ÎSÂ)¾6þ·KíWCRhÍÇÉqò®m 6ls +@wL#Ú}0.ü¢$¿)ë6Ë.sti Jíþåþ åáÊ ÈìÙh9µ "TÊ© É÷ÐS -J!( AeÕÙ×X[ñ;Wõ´'IPG¶T[ ãÙjìe¾:¸ qüËÌ\²ÅÍ`¸ d .Aµà ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~ Ù x l::«Ä UUV U :::::::::: VVV:««ää«r ä «:Uä « ä«rä«Ç««r á:U:: :: ::ä ä ä U::::U : ä V VV $ b1§ì p1 @ ÿ ( label A ?B RLÍKÉÈ 3 JÖ/áksYªÒNÝÔ4 Ƽ¦3»Ã iòl['÷ýpj >á D,i§ô@?ñ TÄÆM¬À àÌvÿ²3l¬Ø LÿÿàÌvÿ²3l¬Ø «ZÿÿàÌvÿ³Â(|¥8 fZ5ÿÿ«Zÿÿ«Zÿ²ó<«, LÿÿàÌvÿ 0 KU¥Ç¸KM-POx®k:3óÊÕâ^»Sëð .ÆÜ§Ï YÊe ¯ ñ,¸ÕÉi¥ª zeÉ~[O/úñ\m¯BL¸yð|¸\!ʵ ³ü8TKÅy^CTü» +µø@ ±iÁº «ZÿÿàÌvÿ Fuà¤úI`8[Y }uäYgÀàm¤|êj@K Z¤¦A| ÿÿÿM ÿÿÿ3WGámtSÍFÛ±d 8](ù·ÒôrÑÑ,½Rk®~ û2ºußíØÏiiÚ}>ǧùøgìÚêÒYJãJ¹çZðìºK@j[uà ÿÿÿÿ ÿÿÿM «Zÿ KUáÜ.:kìu i²]ttz0üª:+_I*£Q$ø$¼÷þ"àm´¯îÄVfÈ%egi¸ÂsàØú£Ý ÀÏOÒOóhٸͦqX'OË> ÿÿÿ& ÿÿÿM HÒ²áý8UÉÅÛÈ]!Þ¢´Ê09rVcº¤ ³ÒMµs¤Sm8Õ &F/ñ¯Ëf´ÊdQK'°2çÉFÖRø@ ÿÿÿ& ÿÿÿM TµÚqª<MÒ¦1¯Ëf´ÊdQK'°2çÉFÖR:© Lpþ*ÀdÖâíÁd.ÃïQCZe ¹+1ÝRYé&Ú¹ß ÿÿÿ& ÿÿÿM V*¸áÝ5!ÉqvëÉf e'¹!~µ°Y ãR@ì¼òlÔêªýVm5 Ñ,G+þ±ú¬®µ6¤RÅç²úI³¨ $ b1§ì p1 @ ÿ ( label A ? g0²Þ À 3 I_á`³Wª¾NÚÜ5 µÆ´T<2V)źCmÀÇi)¯Þ3Að 3 ! f C 0 HÜù-Ôµ?â?.àò¥¬ Ëwñ5JÉ̳r3~ñ_pzõ5È ¥/["gãwÆYÁ\¤¹3!Ô˦Ê}äX.[<kË|ý0 §×( |òyÂ=HÞ¨oýì?Æöïÿk¾ *µJWPjYNòe)Ê·ÿ*S}V"ªÙk¶ñ"ô1½éR[7V~}Î+©üóRùu²úå×Ú¥$±HÇÛB¾FÀ÷ÏÁ º@d¸ R;%ÄEY]DQ!ZÙÄ\ZV \ƶ7¥OdYñ¹ÆµÓ`ؽV]l¾±jKé/r\Ãm¢ß% âmóðFº d¸LÀe´8a\ê0*¯Z\õ´¾ ª § ¿B 9]¤ ÅÌÌæf2»à ÿ º@ ¿} Á½¼¤áC label A G C /redir.php?r=http://www.eclectasy.com/Fractal-Explorer/index.html @ @ i @ i @ø@ i @ i @ð@ i @ i @ä@ i @ , i @Ô@ i @ @ i @À@ i @ X i @¨@ i @ p i @@ i @ i @p@ i @ ° i @P@ i @ Ø i @(@ i @ i @ @ i @, i @Ô@ i @\ i @¤@ i @ i @p@ i @È i @8@ i @ i @ @ i @@ i @À@ i @ i @@ i @È i @8@ i @ i @ ð@ i @\ i @ ¤@ i @¬ i @ T@ i @ @ @ i @ø i @ @ i @ð i @ @ i @ä i @ @ i @Ø i @ (@ i @Ä i @ <@ i @° i @ P@ i @ i @ h@ i @| i @ @ i @\ i @ ¤@ i @8 i @ È@ i @ i @ ì@ i @ì i @@ i @À i @@@ i @ i @p@ i @\ i @¤@ i @( i @Ø@ i @ì i @@ i @° i @P@ i @p i @@ i @, i @Ô@ i @ è i @@ i @ i @d@ i @ P i @°@ ? i @ @ |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5390 |
| Response Body - size: 5,390 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong></strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/high |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 280 bytes. |
GET http://testphp.vulnweb.com/high HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 259 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html Content-Length: 555 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 555 bytes. |
<html>
<head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> |
| URL | http://testphp.vulnweb.com/hpp/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 280 bytes. |
GET http://testphp.vulnweb.com/hpp/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 203 |
| Response Body - size: 203 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/?pp=12 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 291 bytes. |
GET http://testphp.vulnweb.com/hpp/?pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 383 |
| Response Body - size: 383 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <a href="params.php?p=valid&pp=12">link1</a><br/><a href="params.php?p=valid&pp=12">link2</a><br/><form action="params.php?p=valid&pp=12"><input type=submit name=aaaa/></form><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 315 bytes. |
GET http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/?pp=12 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 404 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7 |
| Response Body - size: 7 bytes. |
valid12
|
| URL | http://testphp.vulnweb.com/images/logo.gif |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 291 bytes. |
GET http://testphp.vulnweb.com/images/logo.gif HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: image/gif Content-Length: 6660 Last-Modified: Wed, 11 May 2011 10:27:46 GMT ETag: "4dca64a2-1a04" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 6,660 bytes. |
GIF89a2& ÷ ð|±´{²Q¥s¦ªQ¹®¨[³Ç׳«çGNQ±i¥e¥Rµ¼Úãz«¥R¨QªÄûçèQ°Èr¤¦ÔäéìlqºÌT¥R¬m¡¥h£´Q®Æuª¬\¬}°¬jªb¥T¥á
å,5tª²µ¦®´Þíñ¨ÌÚQ©{»ó´·÷ÇÉ ²X¥«ÌÕ ±±Q£¿Q¬Å÷Ö×ÜééR®R¼Z©R¨Ât¬¹·ÓÛ±©[£¼±¤[«Ã|¨]¦]¨°~¬Q¦ÁR¢¾±±Q¨Â ²©d°t³Ééóõa¨n¡©Q¢¾ôùú]¥R²R®Çó¢¥R¦Àe©yª©R®Èu»ÐàìëU©R°È²µ ±µUR´Q ½a¬ã$R ¼Z¬R¸R°³¯R«Äy«®R¤Àa¨z®ÃÙÚ|ÁÓ\¢µY§g³É²ÍÓ]§y©W± ´ªY©T±½¸R¶W¥§ÐÞU´i ©f©[¸Q¤Àn¥®V ¹RªÃx¦¥n¤©m¢¬R¡¸Q£aª|ª¨TU¤U¡½S¹U¦ÁR«Æ|ª¬T©ÂQ«ÆÔéïâ R¡Ài ®V©¨ÕáZ£f®£ÅÃÁÓQ¦Â\§ÁÉãëQ ¾R¬Âu¯ÀT®R¦Âo¦ØæéQªÂt©¦]¬Rªg©Á±¾©ÇÓa®V«¿R¨ÀÉÝæR¢¼R ¾S«Äg ®æñï ³±¶®¶«[³ÿÿÿQ¨¿TÆR¤ÂQ¡½U²Tµ[¤T¤¾U¢µ¾ßèQ¯ÇRÅQ¯ÃR§ÄQ¤ÂU¼e¬S·´²R³3MUþÿþ???¿¿¿þþýïïï///___OOO ÏÏÏQ±Éßß߯¯¯Q²Êoooæ<C_¤ë]c´´R±É\±Çg¥j±¿X±Q¼SºüîïT£ÀR¶T·Y¤í}²ÎÊs§³ÄÑw§«Q¥¼W¬ûàá!ù , 2& ÿ « H° Á*\È°¡Ã#JH±¢ÅÛȱ£Ç C I²¤É(SªT©Ý¸qæb{ùÒKfÉ¡ÉÐY¯ £."Üã Ö8ØÙ¯Í\¹<,£À¦×2e~ ˵, eZ1cVãPà«13frèc, 2$Xl`¡á H¸ATQ$_`$P$I +3kÞ̹³çÎÚPKól.Ið:àUH6X AJH {18@°à£$4l Ò&ء̶Rð2´sÒfÍ¢E»¶Æ W®B (wÇäÿèª "ÒàØÐ DÒ$Ø9¦* )ÀÀ0` æÏ (àvÚV^±ÃÎ8\-SE.WÈ!Gx¼2GÜÁ#ö E:N%YÄM "¸±Ç$3%ÌT± sÏ%HVtÒ¥åÁZlaÉØ]Ñ D"AL0 l°Àë ÆBR¥ÃÏ ¥0 Â)ædrt ã(c3ÌX2I*HHF"P|Hî| $ØA$¼Hx @ ¥ä"Ìe¥©à¤¦ã¥ z #Ö ²J(±Ã h@¹Á TP!Æilÿ°ARvÂn@¨±pÐ`)ì°Ä²8z¡Å2 C)Lr4xèÀ÷F !ÀÀ' A~èè2H$f\KËFçżìD7#³ó&Ë Zjµcuk¬Á¨J qv¥ Èã«T,ë¬d @B( á(l±$<R9Þ`C`hUh5/^0«)kä²!Æ Å<Á °@ <ÑÀaà+d ;°Ütùæi5ÈoYó2+s¿Ô|§@^q0ÂQä WhôA 1Tà°Þ$@¢JyðÇ Ìÿ _VcòàwDNo3 ËÍhQE1=³u6 <ò AÅ Ä0E$a!`1?b0$ 0r`3w©Ë.sÚUc̶ì5¿7Ñ ðjpvE!^h0ì른 TÃ0b j@Ð@#kf ê(`¾:ø¸0Oáì$â³x5hª -ýo§A"Á¼ xÅbð"!PpC@° i¨WØÁ%.;°)g9£iÐãHPÂÂx¿,¨©ñ¨GÃ+ ÎV¤»¨m C@° Høá>Pà @ ´yÿ¾Ì &(¸ÄL¨ãí 6§2x çXYrQJÐ ,á¿z$ìô Â0D,E ²àôàÀ90q«pâ×ïîå5X'a0jH IîqcDaÀç)ê;cÈËÚF 4tA7°Æ*FÀ4À HÁ) ¨"E< >2ÁÄZÖRÿ"ɦX*)4Fäprj 3¤ Hà °*Bð~Ä \¨\ á ¡²Ä cÉ~õËqÔ©&¡$@ô9|Ü× yBë xe ÕÍæÿB½8/nÅÀ*¬q?`áCPEð0øÀ @,K[Z°.ÅK_I£¸$Öã §(µÎ$¤E*ÿI#b, #Fð/ ÖzŶY ¡ G( ×?ß òqXÉ %ná W|à Xà ÍÙ/cÞ3`J(£%KEbôSÏkÕsÂÇC?<Ö0,Á !¨H&ÄÚUب°:*,müàO8$"hÏ{îÀÄwr³']C @§D E: «¤1 %X¥< U«jHü аHÀÓ°Ø=§ÕKÿv5/|¬6ð õD qJ ¡<@AZ WÐõ®Ð-A^õ:&¾É¯ø1h K âªÁÔA,FQ $E À Ì`µ@ìÀê#³Ç-ñÙ×õqÁ[K."90 @ $p±ÐÂ6í¨=QO â`mð&QåõA aè üáhà·uÃB -áùyCs?RÑèBW£!)Ç7àwr ÙÈÆGÈqnð8 òûqÜ #ÝÈF7QkÀï>I88ndCq²7ç )ÙÌÀr6ÄárùÿÉ&ñ«1ô\ôñSKæ køY 2ÀAnÀ @¢( Ð ¤àgkHá[ D¹L`b k©´® Ü9 ^O8¡ÒRèÄàiëxW {P Ò ÂÈà'´` ´-V$ K((Â:¾°Üw 6nÖ÷1Ã~QFGºñío?9Tüº+Ð+_# åF\8<² .lË}¸{#¼¬ ý88D`Át!~,«@Ú2*Mq8ÔÁÏØ*^°AoHA>(Mq?c¯ÿ;a ü µ4ÃØùu° ´!T÷¬ÁÄKnNtÂÏRÁ´3ÔèÎ a@ðçÖ Ô ôbZB\wÐ2ÛÐnGÖ]/gË;f7G^2¹çN·GÖÝnøy: ë8,ã=íÜ8³·Ë<e}W ßY7â±îo¤Dd?È 3#ÈH (®ðs?_@2è¥wáç%¬CÀ `0 Ä¢ÒNøC(þð )`ÂÃsðÊÑòäâÎ Ò±°j³xÃë¼5HásePºÏÖø¨XH £??MØdSOðÁâ¯vBÿ êÀ ®ãzÓR$Êu¨ã®eÀÀ þñ+Ôø¢áÀÝäosdà@f÷cU´n xâÆûæ vp¶nó6vSx?&w·xÀvóÆKà0GF@hp r`mpA@r ³¿ÀfTQ `ª ðjÖð 90¥@$A {(µ{q@9; x ~&9|tPi ³t }Ö Á`IC$Eçg*0r ¨ +> ü0P0 pBà@ÐV0àP`mÀ0e`W .ðu op÷å ?Pÿ8¨nÈt§ãï³à ¸xÖu T?ù÷ ðz@f@ ~¦ V à Pi` ª0~p y´G³Î WµH0¦à Nh {àS|t¡¢2×sȤBmp v0A¢ ÝaH i° #fÓÃ$P F0P«0 !Ð )нÐJìw. ñê`èÀðv vLÖ¨v8ØKYw¸·2ØP&Éek7ÿÖÈ,A'@ ¶X Ä=ÿàgMγ ¶àgwܳÁÁv ~ ·@à }tJð]÷6 mP ×à ÙÁ°st0 rc0 e m°C$Gt' `nO0~Àjàuîp+Pu-@m p~ø~Uµd ø§ ám a i !Yño)É ùä8Y´Ú `Ðg ¸ àgxÁ6ºµ²àg¬!#PG1³°À _ $ÈW,GIJp9pTÄ@$Ã`6ÎÖOÌØÿ g \Õ ^5ßXX d@ ÓP `¨ 2ÈüÀÀ E ( -0Ó`~xµWiK hQPt!QÇyÀp ( 1 x ":¢$z µý'o¡ ) Ðn0` Ô` ¨PVÖ[¯þðÖÀ^À vp]°8j h d6}D[ÐÉ{¡Â Á@p ÐSÞÔm@ôàÎ0C@~¶wayëßY%."I QûàyÀ Ià(°Ú >àueK. pQ6`¨ cÿI¡#á ±o :$ÛPn§qÊ8°8 Lð ~ ñà !æ3ÖðI n`C?i §Ìɤ;*0» Ý( Ï H¨@Ï q£A0Ú ²J à¬?èBt+1Õ DéÜÒ BP§`®C#wÈ § EàjK:¨µT¨iK Þe qV4J° ©ù¡Ø©àx ± ¥©(zëÖ,ÁF $@zp²B1°~ ò n@¤g ¦'îÐ R¤"k ¥ÿÀ ðÜØ´µ{0Pù HàgÀ ³9xt@*Cr$TÀ¿P =¥6Ì®q3$VS 'P§ZAD¾ <píGõZKPt¨ ûZKº ©¹Ûf ×wmª°p¶oºFÖ¤y¢'m è°¨ø C OÀ,P»hi@spÖ \KP IðO :ð¹ÖиÀ 4¡°;pÉ$Uh NP6Ù~æ{ðs '@Æ ÀÃ; ê3û£sPxð<}P l®ªrP ÿ DÀ 10ek 7 °¨gÕã¼ÐÌõ¶#¯LØfK ö»D Êù I¶ d\¾$"º [ äÀe¼©ª¤ §¸ Þ*ù¸[»o|pI` î K0î1" £NÀÑà£~æP X @¯ ªöÐ; ¡ä´}Ê@©p[èg= ò~@£*®£* ßègBÐ p à }H· ¯Â 1Ð @J\p n û¨ FÐ °u'A·¶4]ýû¿qÿËDz\Æ - <Æ|{xûÂ8± ©zeÙve7pëÁ ìK ¸#¡ 'ðý 0[ Pà"@r%ç²j·ò£ið {0\Ès9k6¡q»uR0 ̳ :pFÀ"ðþ ºLq* «nS0 þpÍú<Ü«4 ð$à# xÜ}*î+¤ ûHÈ&¿üÊêðu&0¡üÛ Áv¦h¡"ioßæ {oëÉ iÁo×0§xûfpTöÈ (ÚpIPulÐ Ç`F ã° ²êéP1°êÿá¬hðB\rÊ@)Ȥ: ÛlrM h°D #Àp ð <ÀÒÃ;Ã7)2,"m<V²¢Î1U71p%ûY'¶Z'S0C0½è^gKe`#ÁÏL$v£Ø Þp ß íå "ºdCß ¢ç °Aá××°fì£ -Ó%@àEEÀzð3- ½°(``$0 ¹ê¬j¬½° ðÚ¡0 Qp zTG >÷ÚM Ìg _ ÑÀ+°Ü@:À °oÀ*bÕ{P_²BÓ1ÿD0Op%X½`00 B¤Ã2F¿#Ax{ökÜF]øýx!] m¨7² !À 0\n (0 C3 ®0¬ø Xý<m£½Z{á¨Ñ²HOÛ¶ ¸Å:ÐÎp¼ ðC0 Ø 1:d ü KPÐí%DE*%Ó#SX`ü £ÍI%_ lP ~¸.eP Ð%1`e`ê ×ù=æG àB $RX'¨7ÀpM~àYwÐ 1pà4; ½Ù«½ Fð öàÒÿDB| N$] 9 ñà63T+F0CÀ°BD@ 0°ÃÛݼå ,@7vÁî@ °\<Ðà0C0pÚ l0åd^ìÅ¢ ®@÷w S J®¾û±äBéÀ U'C ¨]_iP b` Þ<Ô`è,`Ðd c@»þè\e$ÄÅ;%~j BP§Þ³¢ Ó ÞÕ§$n0~0÷ ±wÀ^B$à @"ßÆ~òyvp$ <ÿ0 0 ¼ ¾¼ °CÂ8êÎ a MÏó<b° @ d@c@ ÞéRÿ ¾½Ôà { O0Ç >à ®Úë< l ÝêSPpÚ|î ¶7èyp"~ (Ó3ø Äò_ *?=:@à ðõl@:°Á Fð`c+£*.7¥8° ®V{0èq xà@O õS à1éhà0ÏÑ}`×# +zú!À0çîðt# 0]0á²PðKð`×ÿS4àñ_I1bøæ ÚP´²ò@ð^&L¾b@ ^7¨oàûËO #<EH³`1ý) Ô Å *$åSj ±(Qd$Öq *¨pPA¸!$-fIÃ,StD §Ñi½|i@b@@0òtB#)ÂC(Z´H`Átnb ÀbÃ0Õª#[ÖìY´iÕ®eÛÖí[¸qåΫM 6èâF'HQ$@$A1Èó ' éºz5¸!QÐ5qSÚ4139r8x5Ëå4a¨Ôôá¯*½qD @äîÏÉ 2òs@¯ú !(ÀðaÀ üðé5Í ±tÕ¯gßÞý{÷Ú80èÀW®Î$úÐèÌWÈ8ü\æ"Ð ]`C?<îð>W6q¥¾A2 ä;ôÐCûtéà@ A/Rø BH¡ ÐÂY6!@ ØØä? {ð8áÞ $0/x8¡H yM@8¾AÄÒrK.»ôòK0ÃsL2Ë4óL4ÓTsM6ÛtóÍ/ ; |
| URL | http://testphp.vulnweb.com/images/remark.gif |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 307 bytes. |
GET http://testphp.vulnweb.com/images/remark.gif HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/guestbook.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 340 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/gif Content-Length: 79 Last-Modified: Wed, 11 May 2011 10:27:46 GMT ETag: "4dca64a2-4f" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 79 bytes. |
GIF89a îîî !ù , &yÁÝ
dJVìLÒimÜèQ¢e4BlêÑ*ÇíÎQ ; |
| URL | http://testphp.vulnweb.com/index.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7994 |
| Response Body - size: 7,994 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>r4w8173</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5193 |
| Response Body - size: 5,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Blad3</h2><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=3 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7880 |
| Response Body - size: 7,880 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Posters</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5311 |
| Response Body - size: 5,311 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Paintings</h2><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/login.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/login.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5523 |
| Response Body - size: 5,523 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>login page</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h3>If you are already registered please enter your login information below:</h3><br> <form name="loginform" method="post" action="userinfo.php"> <table cellpadding="4" cellspacing="1"> <tr><td>Username : </td><td><input name="uname" type="text" size="20" style="width:120px;"></td></tr> <tr><td>Password : </td><td><input name="pass" type="password" size="20" style="width:120px;"></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="login" style="width:75px;"></td></tr> </table> </form> </div> <div class="story"> <h3> You can also <a href="signup.php">signup here</a>.<br> Signup disabled. Please use the username <font color='red'>test</font> and the password <font color='red'>test</font>. </h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 293 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 975 |
| Response Body - size: 975 bytes. |
<html>
<div id="content"> <div class='product'><table><tr><td width='180px'><img src='images/1.jpg'></td><td width='400px'><a href='Details/network-attached-storage-dlink/1/'>Network Storage D-Link DNS-313 enclosure 1 x SATA</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/network-attached-storage-dlink/1/'>Price<br>359 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/2.jpg'></td><td width='400px'><a href='Details/web-camera-a4tech/2/'>Web Camera A4Tech PK-335E</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/web-camera-a4tech/2/'>Price<br>10 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/3.jpg'></td><td width='400px'><a href='Details/color-printer/3/'>Laser Color Printer HP LaserJet M551dn, A4</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/color-printer/3/'>Price<br>812 €</a></td></table></tr></div></div> </html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 365 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for buying <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for buying <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 348 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for buying <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 335 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 313 |
| Response Body - size: 313 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/3.jpg'><b>Laser Color Printer HP LaserJet M551dn, A4</b><br><br>Laser Color Printer HP LaserJet M551dn, A4<br><a href='/Mod_Rewrite_Shop/BuyProduct-3/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-3.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 319 |
| Response Body - size: 319 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/1.jpg'><b>Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br>NET STORAGE ENCLOSURE SATA DNS-313 D-LINK<br><a href='/Mod_Rewrite_Shop/BuyProduct-1/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-1.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 339 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 279 |
| Response Body - size: 279 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/2.jpg'><b>Web Camera A4Tech PK-335E</b><br><br>Web Camera A4Tech PK-335E<br><a href='/Mod_Rewrite_Shop/BuyProduct-2/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-2.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/1.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 323 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/1.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg Content-Length: 3551 Last-Modified: Wed, 15 Feb 2012 08:33:19 GMT ETag: "4f3b6dcf-ddf" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 3,551 bytes. |
ÿØÿà JFIF ÿþ ;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80
ÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÀ " ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ? ú¦( ( ( *î§eb »º,vgüºÐÊ+Ö~&ø{LÜ ÁÇaÆ>Jâµ? ²§X£¨ÿ Áür? {màüqÔ~óI³aì¼}Oó«±|teAV?ì]úl4íÔWÃñÏO?ë´{ ìÌÇä+NÏã.rv;TÏC¶4`>§wJ ôú+âíÄ××Ú'ý6P1ù¶|!ã ÅöóMáûôºXX,µ=2Ï=( ¢( ¢( ¢( ª×÷Öu¹þæhGåp£?SVkÁ¿h Ûû_XËgyi·;eäã±?(æ;}[âï l%hãºíÇüñÏÔâ¹-cãxU?ÙÖ$ g%YÏô μ |a¨ û>àwÃ)þ´ÿ øI óq¡ÛIî¨*¬#Xø©â-H²$'AÆG°®NïYÔoù÷³H; pSß\> ÒOúýÆØÈþTWðÔ¼Kms ü Å"ýñÀ8oÇ¥8!_¼pAÚÞÇ·áZyðĤ¹":p¼gê)VÃE8ò5R¸@eè=8Ç ÔX Á=ÃY¡ Tú;V:+ªù·sÇn=}±øÖ¼Ft¶Zf¤'p1 Cµâب´ý Q×e2j·ÎP øfÏ8ÀéÚÍ»kÃÚoËPt óíúæ« cÄ:¸Ù¦[-¿@Ê2@úà+oNÐt5AHDÒâÒ¯Mv1@)åbð¾ù<íRåîfîY~¦½ö{µÛÄ:Àìã¿ÎµæòL[8àW¬~ÏPî¹×'=U!@~¥ÉþB° ÓET(¢ (¢ +Å~1Jþ Î eW¶F ¼;ý+Ú«Åþ9¦5hûÖ~Lÿ ã@ !s¦øvY I¥"·û$äjoiºe÷Å}"ÁmUtû Q,) ó{¼kGáÿ ÅÜÐÛÝGþ=VÐo¼ø{á¥Ç>y.ÊmrÍÁ=O^õÀü`ð.áÿ ú¹¤&§Ì j·{pw03Ðÿ j§ÅWPñ^¤Íqæ¬ N$#ÉPp»G@1÷$Wñ£âÙkPW縵¾KQ;òeE$÷ëûQ(J)7ÔOCË.4àPÛßÃ*ã,J?ªwðA$ÖQýÓçWâcå§'¥VÔ¾Ç(Éû¦y. <kÖ|9%Ä07Ú¦;¤l¸]¡A\ãõë^M`37å^µ`6©ôò@*PÍc;¿SMÏ µ;uP^ßû=Eÿ m^oï\¬÷Êgÿ f¯ -é^ùû>ø¤/Û¹¿oý &§ÑE# (¢ (¢ ñï«þ§X ~Gÿ ¯^Ã^EñÔfm0÷ò¥þk@ 1ùlü.ø¥¢ óæ/þÍX³ýóUwÍi¨YßYÌÐ]Ã*lNùò85lGÖ~,ð â{µ¹Ô#.@ÛæÐ0 ùW ûBiVZ'ÀÛÛ 2Ý-íb¨'êM.½¯ÝêZ6}#YÇqu¦[Ï*±ÚK3|¾zg¯µp?´.olt_Û*¢MiÝÌîrXíÈ AúÆ/} ¶<¾aýÑüª¶¥ÿ sºjÚ¨B£ªZÿ CýÓVÉ9-(n¸Qê½^Øà8 Þ?á^W¢ ÝÇþð¯O¸cêÍüÍJyM?5]Zº¨D¹¯ ?gßùo?ëýÿ ô\uóØjúöz|øFý}/Øÿ ä8é0=J(©QE QE Wüs?é~z$?¨ÿ õÊñßr¦Û'¥« ÍøPM÷gß!qÎ?ÿ Ç hM÷[ðuêÞ4°ÓY¶¼øXØäÇrNLâîu#+Âãb¾4·^G½y×ÆV'âV·º=¶?ïѯrñâçO·Ò&µ[m>Æ;eyNýªN À>£ZòßÚ#·Ú5Öâ¸Ëmöhl® ìuL}Ï>£ÞÕlÛ8#Þ¨jgsºjþàW>¢³õn,fÿ tÐÆs:ü~Eþø¯H·|¦}Ïó¯6ÐÏú\gý±^dÙ}Oó¤h+b¤Ö«Á©w4ÄO÷ÙÎmÚ>±÷'GüÔý¼¥Å{ÇìÝk:izÍÔ±²Ã<±,lG ´6qÿ } O`=(©QE QE Wür wg÷,ÐãÒW¸WÎ / -¹FÌt<ô4 <¾S5«ðÀÿ ÅÞÐWÜü-`È»î k|+Iñ£BÚr0ßú.J¶#½ý |KâmĶÿ Ùwv¶Â{uý\Í0Æç±è1W?h+©®þXOw ·¹KW 1±ÊF>¹®Å:åú|aÓtu¸ ÙN[£FO1ÆyRAÀ ®{öÔ!Õ~Áql$I¨Ä£ÌBã¡úT ðÃÂYÚÎ>Á7û¦´[k7[8Óæãµ[ÌèÇ)ì»Ë3=êkÒÎ.ÿ hWia'Ë(ô¿J®®^Ë֫²O*E 3Èçjª}{GÃïI§ùz¿ËyÃGlyX½ÛÕ½º ¡þø}&¡åêâ4V Üú/êkè? BY<Q"Ç`V,qÉ®B]¶îÿ ÐT¶3F) RÑ@Q@|ûûAxP×¼C£¢,2ÍäªM¾ÆÈèU¾ü«è*åüAn$½vÚ3Ïá@ ]øgÅÚn|ý*õwUYÇê Pðίwá_ÚëS[¹º¶'lsÂȸ*ÊAÿ ¾«ë£n½ÕÐÔQéPê"Úx¢7üô@GCþà×ÿ ´}wÄöZæ£e}knźÊé6º#ÚC¦FI áEOñwââoE§éÞ%Â^Çpc% (Ý<ò~µë¿Âÿ ÝÊc¸Ò´ã+rcËcùb¹ càvxÖúÇ' ¤¹\þ9¦ÎÇZ·R¦Á÷B?¥A©ÝÇq§Jbuaßi¯dÔ>JAþÏ×UÇe¸ú\®§ð[Ä°0ÛØ]XdØOç.éËpë]Ï tÛÍj÷ìºt/<ÒÈv ½~ô7¯\ë i>< ¸nP<µ »ºú{Á>±ð¶ö{4 rã÷÷|Ò Aè¾Ô 3üà[O Ä·l¹ÕX|Óc+²wEKun8é Ç[ºJíµÿ Ì:×° ôfJZ (¤¢( ±õhó9>ª+b¨j ¹Áÿ f0u&5XØÿ #VTû8ñ{ÿ = >æ ÚÂ3 ,c> ÓuôÝfþëSßË4s :Z51æY¡Æ2ÀÐ<ÖÁºj7¶ §µ¼ªdåM c¤ ò*ÌQ`=jÒCÏJ"ùÏÖuj8éÑÇVQ(¨~Ôb,{Ô*f! ühôQE QE QE ^årGÒ¬Tr â(ùtèÓd±Ò¬ì¤Ù@ ì¤ËÔqQÞÑîNjb¹ÇÒéçÒ)ùTwˤ1Ð?ýjø£Ùó·Ö#D©Ñ)È* "I@¥ ¥¢ J)h ( ÑE qE QÅPGQ@ ÅD@Üh¢$P)ÔQ@ EPEPEPÿÙ |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/2.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 323 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/2.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg Content-Length: 2739 Last-Modified: Wed, 15 Feb 2012 08:27:20 GMT ETag: "4f3b6c68-ab3" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 2,739 bytes. |
ÿØÿà JFIF ÿþ ;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80
ÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÀ " ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ? ú¦( ( ( ( ( ( ( ( ( ( ( ( ( +Xñ.¤·wKæùf3~C§ã@4Wj tË{ÞÎiNæ çO²ø']òéMÇï¹úãmSækA&²=*äôÿ éD,Í-³ ùè¹ ®Þx®"Y`$º2A© h¢ (¢ (¢ (¢ (¢ (¢ (¢¹^ ÿ oÃSÞ£ dàó ?(â7ÁÛLÒßýì òìzòi§v,ò9$òI5uâé%¼ycvv,ÛòKgÔè4w²ñF-Ö2ÌÖä}²Ñ\3Ƨø£¶ â¡- ïí ¼J $³÷'ÜÕÈu@ØÍt¶^îX^ Ã( ¬;ìmþÚ¬ ±âXh6þ6ÇÍ[ºnô Îc·?4då\{»â?Ãg 4mæR_¾|avÜâÜú§ÃÚž·¦¥Ý±Æxt'nâ´ëÇ> êlum÷ñÕý7W±Õ"°QEÄQE QE QE QE ã´j\ÜiúE´4ì°ìËü@ÑVÒRH#ó.-[ÌTîë2|*Lksâ/ØÞÙéHÂ3o`Î?àn½?|y ÔrGHäNÌ6çô ö_>qi=öÁÒUÚêà ±® ÂÞ´´½ûb´þ[ ªÒ Dzà ëR=Hñé·Ãndkt&|eAãøWmcãëë}ÑûÌk ä2 ÄäÖ¥¦öx 9Gô ãéF A¯øÞúûQû B IäòGúô¬]{JÜ\ÄG;!âd»ãÛ<~µsTÐÞAso .±õ%7CVÔ)Ïå§d'§µ;»ð)Äúj÷Dÿ ߶¯~¯8øE£Ä×£óY)`=rxü+ÑêáEP ¢( ¢( ¢( ¢( ¢(ñ/4Ýj) c[kÆùÈ óî: ç^9â?kÞ »_Û=Åô¸nP=ý?ú*3@Ó>h:¤;G)'ûMþÙÁÁ פü_¸ÒôkKs.eq%âÈpP+Dà §§#'Ö¼ïÀ¶ðE¬YiúÞ ¡%õÊ,2¼åDqw ä8# 4¸ÕÔ̬#vfà 3] ü¨jÒ$ú=rC HãÐßS^©§húnÿ 6ð Xã þ}kB¹lía³¶ÞÚ5Ô*ªö5PHQE QE QE QE QE QEcxÄv:·xäÈÃä~ó÷ ã|gã{muµ [þë?÷½ý¿q:¿Ä ^ýml <Ëþñþ®PËeNI'$W)Dµâ-z÷Z½µ)ÚTVΠ¨öÀ¤Ôu²CbÖ¸B_ÌVÃ'¦ç5!2!wûïè)ö2ÞÝÅd¸"SÚøm¯I¯øn9n}Ì-åHÄcwò?¥uu àÏÅá Îù>üÏýç=Ãé[´Ì (¢ JZ( ¢ (¢ (¢ Î×õXtm*{Ùù¼Ç ¯õ-Në[Õe¸ºrÎç$öÐ{W¤üaº~h3åÒêzËμÎâ '9wK®A qD°§éòÝ̪HGV' }#OÕ @g°Ib,´zkKÆ- 4r@ up qz¿"ü ¤g«\Å¿g¤\ »§aì=ëÒ~ è>j˯]'s°#ðfþxÝê½°Ý-Ä}XàWÖZ.¥ZX[ Co}ñßêzÕËÔV&·âm3H,ù gÈoÄvüq^Uãzíôª7îÜÿ Aø~t +â¿YhQ2ef¼ÇÂû±íüëá¿5 gZÔäÍ$&0á p ¸'ò¯Ó£«^¯dy[ 2I5ô|7ÿ öDä5ìä4Ät\tQôÉüI nÉ EQA!E%- RQ@ EPEP-ãß>½eÚvä Àpz®ò{k9£ÕÖéCm+ Å}Uo´ûKøö^[Å2×8ú Ô¸Ó±¡i±Án ðØè À ÿ Zá¾,h§UÚkdYZßpòËãü+½ÿ bÍ8¶öÙ}"¸`?\Õ+C1ùµò?ÚpOò¢Ã¹âº_<B÷ÖÖPÚªD*©ïæ½1nõDÓ oYóê¶å 'òë[ðø.ÍÏy~ÞÞhùUÈ|)¤FC5»JÞ²;7éQ`¹åz{¬ÛiÄÑ!^¾ürO½;Føc¨ê,º-!êwòÇè¿ãökh-Se´1Ä Ò¦¦+^ð¾áøñef# 3òçüÒ·h¢Q@Q@Q@Q@Q@Q@Q@Q@ KE RRÑ@Q@ KE RÑ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@ ÿÙ |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/3.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 323 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/3.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg Content-Length: 3560 Last-Modified: Wed, 15 Feb 2012 08:28:15 GMT ETag: "4f3b6c9f-de8" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 3,560 bytes. |
ÿØÿà JFIF ÿþ ;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80
ÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÀ " ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ? ú¦( ( ( ( ( ( ( ( ( ( )H±FÎç M `êÂÉ+Ço)U^ä ~µTj2ÏÄߪ> ÓM¦ Wd¸Ë<:f$ÿ :ÓÐÿ pPcRùøó4ñ¨·ü÷ó4Ñ ³3Tܼr*F´cèq@ Ôþ{IùpÔÏüö«É`?åìÃ5VKYÓø7Uæ4¿µ?é¬jùë%b³`àð} BÉ æ;F[¯½ tVQÿ -¤¨_¶K«ky/6MpÅ"V8.Øί ×;,`wýöETÁµ-sJHe³Ym\ÜâæMªT ~ldç¯J ïüé¿ç£~th$yÅ;g½4Ä g4 }¢_ùèÔ}¢_ùèÔÝ«ýáùѱ{0üèÔzQª©`ÇI8óâ¯Ö ö±Ï Å2ÆÖ¸¨|?«¯öú äÛïm<nÝfûáúg½ tTQE 2icgXâE,ÎÇ@êIì+ KäÔãI }ÖÌ7FGF£V?Æáޣ墷%N×C~¨ìçÖÚ(!\GQÀb6Õ<(õ¬íúÓ ÿ ·ë@ª?~U*ìÆöÿ oÖíÃÓõ Æö¬ÅÔvôþtñªî µ,!Æ$@ÃÜf¨Magfä>Ç"¦© q +ú^ ÆQÕ¾9Ë»)IL8öàÖGQã¨÷£ªÃ$q$\gð®Îæ´àÖaõ&º#? Í÷¦r c¿zï yǽ x?> x¯Qñ§{g¨iËoqs$±Á ÌHÈÛïV| ðÅztÍNòûO{{iÈ©;G|µìï{?7' >Õ Åé|¯(`#ÚÏøg é<ïÍx×ÅÍGPÒ¼m§ßilÉ2[+\pC·ô¯Jë÷([;¶îÆsøã?JòºÁ²Ö4ì(o29öoþ½ }áý@jÚ¨ .íão¦å ð®O7áÞßôê£òÈþP5ûCÌaðN7êëúý*#zÒþÑãþ(+cé¨ÀF¨Á ëJ%oZPho5½hó[Ö¢ÍA?ÙìææÄhÎv Î õ ¾szÑç7qÞÖnï'[;ËË3O) 6îà e#Øûë Kç7 ku¢&ÐÅÔ.`LØô<ÖuÖ¢ïª[Á#ï 0 ¹Ïýô?Z5|.«mu &u#dV²Å#$ |§¿¥ kùëKæ1ã5öë¯ú]ßÈ¿øº>Ýuÿ @«¯ûùÿ @J®L|/P ÐQ§µ1ÝG¸8éù R·'®r=ËÅÿ Å×ÏZßµÍGRuÔo-£.vC Ìþ´ô®æH¨ڪ0 W|p½K½zÊfS%¼$H Î 9ëç\Qñ&ºAXÔ?ôòÿ ãYáÙÜ»±f'$híÀ¯Ã/r~Ì2E?á ÇÃoתÿ 3E s_´xÿ }ô¿ÿ èU «?´hÿ uKØOêj¢ ?4¹¦æ x4 AS3K@ o'D'#JÙêÌÇ$óÐ Sis@ i(&4 ¹¨Aýÿ üÔÔKþ¿þ¥ M3InhI¯$ÿ Xÿ ïú´ùEþû}M 4Ó£&M }Áðcá¿¿ëÑ(¥øT1ðçÿõç ò¢9¿Ú,gá¼Òîú §å¡ûEÿ É4¸>0üz²Ñ¾Aô ³@5 ïzp4 úPi¥Í ?4f3@Í&i¹£4 ¤Ô@þÿ þO&¡÷ÿ ð@æi4 f¾QcÉú×ÕD×Êdõ &y¦±¦Í }Õð¸cá×ëÊ/ýwÃ! ÿ ¯ôE s?´Wü Ãé<?úcÆsý+göøW©a#þþ ðKOzÁk; víþ5pMØö )OVþû4ð;¿\ýó^F>(_Ï¥æßãN oçÒÓóoñ«ú¼ÅÌ]Í«É?áhÞcþ<í?ï¦ÿ oü-;Ïùòµÿ ¾a0æG®î¥Íyø©yÿ >6¿÷ÛSÅK³ÿ .ß÷Ù£ØO°s#ÕnÒY dáä=$U GàxªqÙß©µi_ s c?¥yÇü-+¬gì6ß÷Ù¤?î¿çÂÛþþ=ö°s#ÔÊM±r,ÛGÍíN÷ÿ ð^P~*\ùp¶ÿ ¿·<ã+ß_ÜGº¤åÍ`2HÀοåYûMÍs¿&MS2j?óíiÿ ÿ ÄS üûYÿ àCñ ]&¾VþúhI¨[ÚÜ?û%|Æ Á= 1Í4 hsHhï?à ü8?é ý QNøv1à/úÁÿ ¢ÅÌ~ÐÃ? õOúéþZñ¸¾è"5ÿ HÔ:ùhüM{'íÇÂXú< ú5kóóØUFN;®qð«4/ùïÿ ÿ |+пçâÿ þþ/ÿ ]¸zPõ^Ú}Ådq ðªô3ÿ /ÿ ÷ñøOøU: üüßÿ ßÅÿ âk¹ó)|Ê=¬û  : üüßÿ ßkÿ ÄÑÿ £Cÿ «ÿ ûíøî¼ÊQ% Ö}ÂÈáÂþ~¯ÿ ïµÿ âiÂþ~ï¿ï¥ÿ ï7ÑæQígÜ,þ>zÝßcýåÿ ì|=¡éþ ±û.îvcsêM\ßAzNRÝ ¬MæqU?´µ7±ØâEM»¸$uÎxô§ÅdÇg:ø}Dº}í ¹;bN:cTÛ-_+©Èo÷ÛùúSYÔ¢ÒôËÛ8P·=Ïaø+æx*sýãüÍ #¸SiëÖêóý<hïo xÃÃþ¡ðèµ¢àahþ ÿ ÑkE s ôû½Sák§ÀÓܳDV4êq*úWǨøõ"U>R@ õÿ Ç«êË¸Ä t5±Ú¿ |±ý«ãÑÿ 2ªþgÿ £û_ÇþeQúÿ ñUõ?ØbþâþT`ûùPË Û>< ó* Èÿ ñTÛ: ó)·äßã_T} î'åGØ!ÿ iùPÊßÛÞ: ó)¿ýòßãGü$ 8ïá)?ïÿ ú§û> ùæ÷È£û>ùæ÷È á"ñ¸ëá)ï¤ÿ Æ£¯gÿ ¾ ¾ªþÎþy§ýò(þÎþy§ýò(å_øI¼gß ÷ÃÑÿ G{øBçþý¿øWÕ_ÙÐÏ8ÿ ïGöt óÊ?ûäPÊðø¼uð ßýûð ø¯Å¸8ð}æëá_Uÿ gAÿ <£ÿ ¾E ÙÖÿ óÊ?ûäPÅ %ÿ ÏÄ,«{£ê n§+ vÎ SÇ'ëXIá_"Ú&¤Iÿ gõúWÝÒhöìrªÓ á×¿è ©à3ÿ =<3®îûRÿ Àgÿ ûû/AGö4^Â1< ÑaJI (Êz(X×dj£¢( QE QE QE QE QE QE QE QE QE QEÿÙ |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 370 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for rating <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 357 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for rating <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 353 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for rating <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/privacy.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/privacy.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 412 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 16 |
| Response Body - size: 16 bytes. |
File not found.
|
| URL | http://testphp.vulnweb.com/product.php?pic=1 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6428 |
| Response Body - size: 6,428 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The shore</h2><div class='story'><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $500</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='500'><input type='hidden' name='addcart' value='1'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=2 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6368 |
| Response Body - size: 6,368 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mistery</h2><div class='story'><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $800</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='800'><input type='hidden' name='addcart' value='2'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=3 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6401 |
| Response Body - size: 6,401 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The universe</h2><div class='story'><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $986</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='986'><input type='hidden' name='addcart' value='3'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=4 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6453 |
| Response Body - size: 6,453 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Walking</h2><div class='story'><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $1000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='1000'><input type='hidden' name='addcart' value='4'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=5 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=5 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6382 |
| Response Body - size: 6,382 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mean</h2><div class='story'><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $460</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='460'><input type='hidden' name='addcart' value='5'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=6 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=6 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6454 |
| Response Body - size: 6,454 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Thing</h2><div class='story'><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 99 cm x 200 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $10000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='10000'><input type='hidden' name='addcart' value='6'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=7 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=7 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5734 |
| Response Body - size: 5,734 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Trees</h2><div class='story'><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>bla bla bla</p><h3>Long description</h3><p>bla bla bla long</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p>the price of this item is: $15000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='15000'><input type='hidden' name='addcart' value='7'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/robots.txt |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 249 bytes. |
GET http://testphp.vulnweb.com/robots.txt HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 259 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html Content-Length: 555 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 555 bytes. |
<html>
<head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> |
| URL | http://testphp.vulnweb.com/secured/style.css |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/secured/style.css HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/secured/newuser.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 343 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/css Content-Length: 5482 Last-Modified: Wed, 11 May 2011 10:27:44 GMT ETag: "4dca64a0-156a" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 5,482 bytes. |
body{
font-family: Arial,sans-serif; color: #333333; line-height: 1.166; margin: 0px; padding: 0px; } a:link, a:visited{ color: #006699; text-decoration: none; } a:hover { text-decoration: underline; } h1, h2, h3, h4, h5, h6 { font-family: Arial,sans-serif; margin: 0px; padding: 0px; } h1{ font-family: Verdana,Arial,sans-serif; font-size: 120%; color: #334d55; } h2{ font-size: 114%; color: #006699; } h3{ font-size: 100%; color: #334d55; } h4{ font-size: 100%; font-weight: normal; color: #333333; } h5{ font-size: 100%; color: #334d55; } ul{ list-style-type: square; } ul ul{ list-style-type: disc; } ul ul ul{ list-style-type: none; } label{ font: bold 100% Arial,sans-serif; color: #334d55; } /***********************************************/ /* Layout Divs */ /***********************************************/ #masthead{ margin: 0; padding: 10px 0px; border-bottom: 1px solid #cccccc; width: 100%; } #navBar{ margin: 0 79% 0 0; padding: 0px; background-color: #eeeeee; border-right: 1px solid #ccc; border-bottom: 1px solid #ccc; } #content{ float:right; width: 75%; margin: 0; padding: 0 3% 0 0; } /***********************************************/ /*Component Divs */ /***********************************************/ #siteName{ margin: 0px; padding: 0px 0px 10px 10px; } /*************** #pageName styles **************/ #pageName{ padding: 0px 0px 10px 10px; } /************* #globalNav styles **************/ #globalNav{ color: #cccccc; padding: 0px 0px 0px 10px; white-space: nowrap; } /* 'nowrap' prevents links from line-wrapping if there are too many to fit in one line this will force a horizontal scrollbar if there isn't enough room for all links remove rule or change value to 'normal' if you want the links to line-wrap */ #globalNav img{ display: block; } #globalNav a { font-size: 90%; padding: 0px 4px 0px 0px; } /************* #breadCrumb styles *************/ #breadCrumb{ font-size: 80%; padding: 5px 0px 5px 10px; } /************** .feature styles ***************/ .feature{ padding: 0px 0px 10px 10px; font-size: 80%; } .feature h3{ padding: 30px 0px 5px 0px; text-align: center; } .feature img{ float: left; padding: 0px 10px 0px 0px; margin: 0 5px 5px 0; } /* adjust margins to change separation between the feature image and text flowing around it */ /************** .story styles *****************/ .story{ clear: both; padding: 10px 0px 0px 10px; font-size: 80%; background-color:#FFFFFF; } .story p{ padding: 0px 0px 10px 0px; background-color:#FFFFFF; } /************* #siteInfo styles ***************/ #siteInfo{ clear: both; border: 1px solid #cccccc; font-size: 75%; color: #cccccc; padding: 10px 10px 10px 10px; margin-top: -1px; } /* negative top margin pulls siteinfo up so its top border overlaps (and thus lines up with) the bottom border of the navBar in cases where they "touch" */ #siteInfo img{ padding: 4px 4px 4px 0px; vertical-align: middle; } /************* #search styles ***************/ #search{ padding: 5px 0px 5px 10px; border-bottom: 1px solid #cccccc; font-size: 90%; } #search form{ margin: 0px; padding: 0px; } #search label{ display: block; margin: 0px; padding: 0px; } /*********** #navBar link styles ***********/ #navBar ul a:link, #navBar ul a:visited {display: block;} #navBar ul {list-style: none; margin: 0; padding: 0;} /* hack to fix IE/Win's broken rendering of block-level anchors in lists */ #navBar li {border-bottom: 1px solid #EEE;} /* fix for browsers that don't need the hack */ html>body #navBar li {border-bottom: none;} /*********** #sectionLinks styles ***********/ #sectionLinks{ position: relative; margin: 0px; padding: 0px; border-bottom: 1px solid #cccccc; font-size: 90%; } #sectionLinks h3{ padding: 10px 0px 2px 10px; } #sectionLinks a:link{ padding: 2px 0px 2px 10px; border-top: 1px solid #cccccc; width: 100%; voice-family: "\"}\""; voice-family:inherit; width: auto; } #sectionLinks a:visited{ border-top: 1px solid #cccccc; padding: 2px 0px 2px 10px; } #sectionLinks a:hover{ border-top: 1px solid #cccccc; background-color: #dddddd; padding: 2px 0px 2px 10px; } /*********** .relatedLinks styles ***********/ .relatedLinks{ margin: 0px; padding: 0px 0px 10px 10px; font-size: 90%; } .relatedLinks h3{ padding: 10px 0px 2px 0px; } /************** #advert styles **************/ #advert{ padding: 10px 0px 0px 10px; font-size: 80%; border-top: 1px solid #cccccc; } #advert img{ display: block; } /************** #headlines styles **************/ #headlines{ margin: 0px; padding: 10px 0px 20px 10px; font-size: 80%; } #headlines p{ padding: 5px 0px 5px 0px; } img { border: none; padding: 0px 10px 0px 0px; } input { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } textarea { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } table { background-color:#EEEEEE; } td { background-color:#FFFFFF; } |
| URL | http://testphp.vulnweb.com/showimage.php?file='%20+%20pict.item(0).firstChild.nodeValue%20+%20' |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 359 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file='%20+%20pict.item(0).firstChild.nodeValue%20+%20' HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/AJAX/index.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 392 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 261 |
| Response Body - size: 261 bytes. |
Warning: fopen(' pict.item(0).firstChild.nodeValue '): failed to open stream: No such file or directory in /hj/var/www/showimage.php on line 13
Warning: fpassthru() expects parameter 1 to be resource, boolean given in /hj/var/www/showimage.php on line 19 |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 12426 |
| Response Body - size: 12,426 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ù¬ÄìóÛÏ»)¡¢Øéʧç¢Úêôã,y3e®êÀ &ùcÑ[Kôá¶Z8Û! }cÕêóèÝ$óPLeí0¯ ô3]Gª¦¼ûåëÏqµÅU¼$ÅA1 LNù)öUvèÁ÷ôÜ*Umðwk¶«"$ Ëm6äg©> ô:ÛÄ`bj3ÝOIÄI,D LMNû553ëOW 1ñ¾c?¨KéÀÒ "ÓvÊßdyó-<Ò¡Ç2Õ ½M!²Ç]'Ùêìvj²b 4Æi{tøj(Ñ_¥\Ù_ÐÆxï 0çM¦Þ¥ØcÇ t1Saè6ù¦xµ5Ó¹ÝÕoô¨°Á˵ÝmÖÚ<É«- ÇVjrvký¸oò]lÅ]Ñn.ÑM7×ÚVu}ðqÚùæfÀÉ^A£>Úi¹MzK0äç_dïÏx4ñ7¨ÁíÌ¡ô¹öåcZj»²¸ì"fN«²V²½¬6Fâ¯-AFÜ~ÌÕ]¼GaÕrH"H*H9gMÌÒz|¶Å)8Öפw¹¹o:xÔ9}2_D_GËuºÍ±\ötXã#W»:ãæmbg*¾®3ólnWdÞ&Í *zäÑëtEÙ3Ù³?D§§¼\÷ϤéSo&¹¾ôÞmN?C×I\,ë(ë¹é:|NkÈ㿲'ÕÛ K]¤ßÎù 9P ° ¢`Ó¸I¶¢½FõE³Lê7Ýçubú§/µ¦rs´tÎ4GO ÍÚ(Ó͵î¹ù=fÛOÖçF½Z|ÚÈlë ùñÞ T4LHÔñÕo]ØߥVËèVf2{/=q ³&ÀÓ5}OYÓ_;ÅÜUÙ , &&*@Ð:î»»¯²Îë°²ê,4ßA¯V]~mYÖm/uSzÿ £i}yÓkçÐ ÄM hu XvI=óa6òÖ\1ÌtÓ»>~£qbÜa·ßíë?ÊéR÷J¾§<µé¯´óày´@ PD jlØ ®NC¬ëpbØÄ0ÑHyõ²ùúЬ>3Ú ¼±ãôë{sÕ! ÿÄ ( !"01@$#23ÿÚ £ÍÜÀ¦7b 0ÿ ·Í4¹Úºµ°°E2« (ê tW.Vê×Ó »½Ýª¶£óÿ ´lM_äºßÊD ±P8ïùR,ZU»Î[íÓGæ®Hmö¼E°£;ìÄö¸Z©[õJ[ªo¦ÁOXÿ ß%G@eo´Ú~ÚBF»^^ËÊØy^V¹0÷;áàq¸ö ë¹n6\§µgúÚdÕÇ[v ~ÇU©o^N¤Ù¡î¹°l¼3)¸¤[°«z0ZÇGto¿uf$ÒA±0<c¥_RÛXTºfBÐ"ÊjÄÿ ê6 !ô©} < ]RÃJNkmgÑULëÇ_{Ø%{J.ñÓÒ ÕÄZË|ÓVî?XPé]-[ìzXQ?@_Æ¢ç,ÙßÓ k½Ãt¿k(VZîÃ0ù [}u¡bÜr°PÒvñ«ã3ÝâûK©ú(!_£Ëë{ÜæfQMj´-eõjʱô=rÑÓÿ 8ùt*;ª°¬«w[Ôº ib/O¼B!¡zMùìA~;©HqjÜÊOÈ(%NÙÉ9²e5`rlË8ËQP(êqðê-õnÑ*BÒ®>°Y¬°ÓäN·«v«{-3 nÚдâSÖTô[£¤U ^UbkªÒWÍU ¿÷=ÂqíöXÍgäÃß@böÚj¿«/g}¼¢E^ÍÉ`§9µE +!ñµY* Ú<Ü WKjåMj¡Ãu6tá>{賦åö4RδzÖ. N·îc©¼¼hf&!\w ÆRa(®'"ÜÃØö,᢬½ Î7±ÈtmÑ© &µéqjËòðlÄÄÇÏ@PU,E´&¨¶ÖìX`üb&AúÄ®¥µVÁXºíæg ûãDs]¤¼hõ+)FéÐVµu,zóe¨¢¢>VR"زÆ5³r_óñN6é%öQoGs!\ÅòxßèÇÈ3Y±«Âó(å--~KïøbÔ ½e«°'ãJ¯Ûm[qdäLÌÅ¿ÓgXÙbD´fYYøþö¦YP(þºÒ´ âéð©ú)n+ÏÈù¢ºÕ·{¿ç]¢)[&èÂÕSb CùÖ¬ Z§ä Æ`uÛ·*ÈÊZ±[ñÓ$ÛN&DUdÓZõÉéx+ÓPK5|u²uýAÌVÁÛ32¯,ṉÈöÄ--x]YuléRJ¶&Â±× OÓ ÌÄbhfk¦ÊÄBâ;æm,»`OêØ +BÑY@E3ýË cC ?° T1WÖ¼#Tc{ÊÖ«I)´j?¶'Q¥õ2_(}m+£;ͳó²G¿Yä0ÁÄu×ô꨼«Z0ÁÇÅõ'KVZõf U+Éó ÛllÅlEaãÊÈÃÊYÈ ÿ ÿÄ ! 01@A !PQqÿÚ ?zåWÄ!Ü~£¸ÕnDd%L@ëÕUÌATHÉ#_GBâ`oA9ÑH¤Hï÷NTG!àÿÄ + !1 A"02#3@BQaqðÿÚ ?²¯BDÖÄ Öè3 ö»@ `Ƭ5¸ªÞ×tpÂsÃPîZ OÆÈqâ §LLÅÛ¤hç!Á1ùsé5ù <s©1¸ðFá2KåZש{Òºc% xBýê@¿Zr} dóADÒëMx9¡Ü§ Oð¹Pâ1;&?»PúZµ_¤#ÙH]tâ Å dÿ 6Ið"ö_¨¸xä¯^TÄZYr1²YÚù(äp³JõÔ)G¼ø&c_ "2; ()l¸£ÀñÊ=GÇ'²ßnBؽ&1üé#\';Ð6èXm²¾ÏGǹ )ýQ`§r£:40ò n FPê¯ OÙ[PQ³Ò§kݲlO<T=QoóËLáÖ¥ë+ðPÛwEÓ3þwÆÑNF3YÒéÙÛñ@ >ÒhZk Ôu4h.˺N¥¹ ;V¡¸Ü¾·<ÝÍ$8´÷oûL²àòóet¬n9iÔ´fJé ÅDòéÜ¥ÿÄ 5 !1"A Qa02q@¡ð#BR±$3PÁbÑñÿÚ ?`'7,©, Db×lã !À Lùô*x¢ ê tÝ-®å5¬ÝC¢ChÙé·§#ø (gæ YÖÂúØVÈXÛ ´áTçµWÙuÓ;&0tO1o¨B{ôEÜ!}ð®ÀÑÃR»ê«çKͶ=¢&C5²Õe]½VþA 7Q4Ý7¶È½ÆGeADàplÀ}Ô7Ò6Yo·ÀFØÖMù*fͼªsé) »·¥°1~«ùUmzz@ Ðê«ð`(ájC-A_nª ¤ ,8ÙPHØ"î ½þae-»B´2ýL)/Y¨D* ;vòK¥C¥ÚpÊD â.}Í{yÒ º,7P\á h²*Hò§4\Á.?E' ]Tä"Ý0 q:z "¸ThKã(DswòèQºÅ;?nò ¼H¥º ªâcÕÕN£@³WeUP[ß Ð²ÊÐGUNA;óÐDºÈiB.ײÒkEI(=ßMùOF¡J¢à wB£éÍD wYFÄÀQva9Ä*-MHH üæ6C>ê²7\Ä«¢Ú¹½Óª5 =]w~SË1"Ûî³ô^¬ï0!xMv`îÔDþcæ·é¦ Z&êdy¤P¨vÀÈòZ*A*+8ÜVÁ Àè0 ÆnÊ%xfû{¦æVÐÔn¦þÑk½Â¤ùy`¬¶*]^ÊÈw·*Vfí*´D(BNÖUöó=Pø Ú>ÿ ñiÔ$üÑ@ø0ìôT0zcÿ éÈ5ÂxD$R&ÔÃþ]:)Øvh>\ÚÐÊÎ# æÍþKúpÑ·z(ËkBI lðæFÐK;ï @+ð©¬óõUôìU`# 9jí¬sIÜ(*¶älÀüy§QnÉ¥¦» !tSÞU0ùPíèØC>û#@TÍO=H2Aqý*->B'vÖÖYÌ9WHêJ&¥;;`{]ôV)¢ò©«" íJ¦Ìì´ ¸é2ª+('°øμÓYÝJ§¼¢ V$eÜo®_PDGítØo²Ãfë,Ô_±YÞðÓïÙ5º\rGn%¶ÔL*LtS5PØÉüá§êÀV¨Øa 4n\/K¨{FgöEærØþÕý× ÂÒêBým¾SúøÄ @w ¤´oh£·3¹Yx-êïËû§ ½*5ÍYíÑC 8D»ýÕpÜúØHTÒÙë4DíñÔÀNȹ³â8Ìfõæq dl ý¯p«mþ{å~ú§x¹L8åÓdÊíº¿ø<¤D(seÄsÈ©f}ð-ê³8ú¿ÏùG¿DNßRáq6#uxyræ«t äAtcpi0ziú¦°êâpÌÇê¥Ô4ý~ûã_1Z¨"g Xlp¶YÀ¶©9Nè`ýýº£ Æð»b&]a1)¾ ÃGpáÖñI6EÿÄ ) !1AQaqð @¡±0ÁÑáñÿÚ ?! LªûD¨}\ËÄϬu@ÙÌ·CEcÄDj9ñ®µ æó)h?[¿æ´ _m«Þlö>vtx:üøå tÛ0-e1UCLµô¶²xìídçYÌ7FMÛl¦zb ócÞTp»ÕP ©¡³¨gE£/#ÞV®ÕôýÁ´{O橸X<Ec.äLBç å *¥¥kLzFa © +xî/Ñ]ï=så pTÒ Ë #j¤¾9HÔt&Æ ÔʪîQÐv³C GæpAª´¢¼ÿ ³Æ.íÇMöwÔÐøUÄ $it¶% ç´©Û>!úXÖ' µI ªPû7N¼çæ m®åJÂظ`Öþkñ4úó/´Ø¬ ×õ)phÒ bæ3?`U¾ Ô!MëÀD«0 ù&jëe©º£ôáÑn0%$¸=¨H6Òá²cA·åÀ!à Ë~>T¯Â2¹Ù-7)W¬bGÆZ-kAÌlNÔÙoMçäþ¥t6pØWÎ(@BÈ45éßø¹ ÆàסXµ}=à>)»|bCöBTм_>Ñ°*¥ôò%Ê= æv«óqµÉ¦#§Hïë7 ©gµæcÐ rg'YÀ`ÕeÃþe,b¸.%x=QÀÛ ×ñæi´Üʸ zJ0À/l;èaÌ+Uu:é¸q .ÞëÚsÃqD\T9Ä_ÓÚôÅÜ=YDº.#£bùÍ£Füv; 2ÌòêfbªV¿;Aü5 +ÔÕOºµl<Ç¿HV,¤pé ;±lÛï cõVþ7WS4 çõûÒúþãÃ^0X:#0-G'yê0uS)J·ÏÄÎgwazÎú¤qçΡ-Â> ¸»Jgê#eÜ/ÙÂÌï{¹ûg+`-4ñÇzÉ·GþÂZµáR¼6F^!-Ìæï^²¸t)bËï·¦ipbð[7(»Neì<shÖbgJ^ =! Qz@.#ÙÖ RÌ44çé'j¤ »+RÚ@¾÷@¢¿ÝB-Tmô WMüé ,FÚ·ælÄú,/VS¼5Û+h Ü3Ù¦-ý¦M¡+ïÛ',ºËÙø©Àm"q`gÆ/ ïkm\oúRY2év¥²{EQaïQÚ }IR¥xmÝã ¼@¬BëÑ7 Â@|;&7½<λGàwÂ@ /Æ ºà52N3}7¡L©x9üJ¾\TÄë.Äù?¯)ZE/:è^Rëâ Õ%ÈrËôËmP¦¸ ÌN¶¡Iì¿49GHë×Þ»y»áó[Jà+¼J<Äu? ó D§þJkÎصú ãK<´ Ãbj³t1¢ù*l3q ¹ÊTÔFÅÞÇ´Û§hÓt]G^³}¹Ã»SWxy«ÁÅËÄ eGDJî~¤ºÎ??8§ +wpFT©Bk¿ó ÓÔqwGí3¥Ðño/)na8; ¡8Z ¾[Æ yÀRª?gê(_9õ oôí/.ÊìJhååà¿ Dô¯NÀz¯ÏKÎý'Ï´Á^%;Îs@¡¥_Ñ«°NO䥨ÈigD_²Dpñò»@ÕW|Þ +˦Ç6¼K ×<¦]*ÕgY·?¨ÄËYcÿ &+¥[Þï ±jûËëµg Ô=¹8o=&iP&ñá/"ÿ 0ÏR]ø:óX:[''Ï]j$¨ÇªÉ͸Õò·«\w¼ÃAãßÁr]¤ºq»ã0ïlqs$Õs)"ÑÁ/Ö´uÁTZ~j 9 ÝX.:Ä ´7´Ò³¯Ð;xð(4¦§¦`$;ä8ã´r4J]hÿ -£^.|Jp1é=Ü=ûÆq¨÷¬Æ²ÅÙýN r³ ìDrïñÎq*¶JØË9ôïÿ Xå¾~_´Ê[*,.XÉÑéX( ºÊ7YeÈ·vã;fH¹ëµdê[,?ä¬J ~Å úEËðRÚMÇAò~?QÌÊòÊR¿mºkÚHª+hÎ|þq0Eµ«ö·Úq¶Ý §ï´²âÍãáÇ(«Ûí 5;qV&I´°·}Idp¥Nzôcó8±±mhâ·þ°·zÉÛYÏÙ\¸0bÄÑÌÏ¡ø&º'y°¹9 øKN¿ç]yÅdo÷#E2oê'.¬6Vñ¨qxÝÿ ¬À¥r:Kÿ © BZbï ®îåè7 4 õqÖ 8)¢c£Ï§Ó_6Âh «³ÒdªÌ² 8ô`ûCÀ¡ CdåB ^-â 7AXïðò Û^ÃÛã©ÇE§Ô³pÇUZtÓóÚTùº¹±+m¯ Ô±òVÛí5WfÙí£MúBfiÀ0 ûËN ½ ÿ Ø WKíî8ûqà^à ¥N³¬f{'öÃ5$à»ã¤ÈH ×=åÊ û Ûù0Tlº§ã,¨KÌÁô«]ZýÈá¿ 4Õ5¸·2«_âBä{?<_¥JXg :\$\ Ó?ÇÐ~Ôú@ <¦7Vѽù=%BÃbÁ/÷ è²T 3gþ@µ Ö6ÊÕ~GõPXÏ¥~X÷fpǾcA(ó6uöd< Þ4ªßþO(å £O[¯XR s({j QRúD¾JÖØÄ jÞÃt÷w rr7-Á¹k#Fy~8þ b*û" ´//õ[Îe 7໵²(JØ {`Ó²Uä,uõë¿íJ¨Íeã·] Ä n®x¥®qÔ °`Áå]'9`£½ß,5+ I¾ìÉ@*ê72cÈÑáWøß¼¿@ãABÈXçµÎ'>¼ÏÿÚ ºæ³l,]ïÕví´©Ý^ 7üס" t,)û·×4 Ãÿ üÒ¬g½B°`kúÁrc è þÜ;Â¥ÆUvÐl¯ ³vVçÝC S§gÌÃlt¸ÿ 4ËCÓÌa:]v9ãn$÷ ÿ ücvÁ æ3lÜBå WþÃðskº ,0ÿ ÷¬I=d{JH 0ÿ ú¾RïÎôÚ¼¹ß 0 ÿ ˺yËîNÓ ÿ ú"uÐÂ| ÝýðáÿÄ 1 !0AQa@ÿÚ ?ß[^µhnêÝwR½4½ /ÑÕÆÛ¹/j`jlbCt_£]Qé>îóZIÈÕìº'Àey ó¢ÌÁO/må{a6%YÃ67Ù;ôãL4W!s¥q¢puÛÎzn ÒÆ+Àã N9ínº5!£F%èTüãø¼ ÀèùïCSN »Qô9ÖV%«Q ìÑø2!ÿÄ ' !1AQaqð ¡±ÑñáÁÿÚ ?#j¬wó b 0,¸rɳsæD+3W 8ÆND $0¡Ò³ßË9½ñÃÂQFiæ¼ád4;ûÂÛaëÖ"ÌüÂm_ÙÏ}à¬8T©PÍ þ+¯¨ë. ¦¨G·c/ë8 Äau¿çm7à"JÀàÍb% tÏsa¢Ús×î%<ùH< =<ó³wO¾×õýÏFQØ»@¸6¤b¥@@Òó}ÉtW=cG7 Ê&%¯ÀýÍ"í¦|ÇæÈÛÒ´ûÊÔç3ç0E,MrJ̨ìþ¿Ù´Ú½¼òR妽o¦h÷¤º84\l] ¿~$C9+}ü{K UkFs1½höVþöoZ®ß¾yô´iVöVÕ+y@à à¸3E3üuÇuMûvýÿ ";é¾Á zvéÒ sÒ¥ýv¹BÒ¸ÜQÏKúÔ£Ý ¿iU)]ô ¾Z4í£Bj ¯Ö?>ÌK)Û®J»ïûûQVÛRýų= óm;B§5Êó\¢;BülÞÿ ä 85Àà0 !ÖØW.ÛyPé).6M¿gÜ FûÖÞ3îößß5 ÌRäºÿ à¢õãoä eE ±øõYR¦ W7ÍWñ g&M»ôk¬íæºÁVö©¯½¾%ëèsµÙ}ú_㧩¦`ë]ØíéÒ$Gh- Ðô HCÑuKÆSØß±!wPùÎm¼Ö[Uñ®oÄâ H@!Ì|ðP5 ÝñÅüÔGÚÆ5$§ a×è¸; 3¶æÿÄ ( !1AQaq 0¡±ÁðÑáñÿÚ ?ÚYPÙ¼lÈ jðoÏX1 ¬LÀÅ$ÕV¸ x[Ô ¶uo>'^v Ã8}<ËA%J»tÇ]eeDÖ¥i×ù}F0ìµA£nä ôcüf$u Yf'PÖK'è.ÍÜ?wle(6GV骱 ñLº%kÉnøÀr*PTzeN&¯3fÌ58U6 ÷mjÓ¬Þ£b°ï^Ì V)øúh_4Pp;+ z8!º<%ÓÓ8wT2ûøÈY¡#¢S7åï;¸V¬XZ¤Þ_¬ %ì+=d"2ÄHôäÛvëTnH¨ zÁ,iÁ°s¯zÎ0¸ðF×ÊWß {>*¸ãô~ãêa "v C g9]ó5oü8»pè4ÕìáìërG èQß06{Ît`jÐ÷mípä(vd 4o 9\UÓ4üÌ£qÛê³ ~ S*µþ=?³V&%¾ñ)Ü´Üî»ø2o1ªTlô¯Þ!J4§þ¸Uðæ5bk ¥Icw¾g? è 9`x{ÊÝ0Z ¯i½ ÒÆrkTx5®²C ¦×jûUüãöLIö/øA¶¼»õa|SJ#^ß4qpM²A¶ñKùpaF]êU/Å µT,Ö°kte ÁhWnÄpAàßå¸Úb×ÎsGé1 Qj÷Ï÷ÞZª"³e rJþMZÆUOA>²Q[\8ö =æµÇÄ6Æ"+ íw0ÕB¨xXW ô¤"N NÞÜXÐ WÄØ·ÆÆ´øåÈõ xçüc )])Èòõñ?ÊaÇ@ +ý×Æ/ç¡®ü.0e£ å´!(¤nù·úÈ-ì'-øÖÞ t0ðý §qå¾a`M#íÌ ì!Ý-ÿ [nW£A w ¸ ¢+羡£° ´0âHqçMV"¡Rñÿ ÃKªÉÐS7nÓ¡ûh<,G8ÕødµUÄmú?Ê} XÄ ¾WGÎVÊÅ9X|±Àv&áf÷§ûÀ¹1¤5Tä&ÔBLQèk[É@çQe_FPï9sêEUZý3°Çÿ ¹Jg6Më"u¾v£Ú(ä]¸ä ¥¯A S`=å±7iç }'ÒdûÏ¡ôçhñBÐ:ï &È8Ø ó øGâ"+¶í¨SxÓrÖºZ s b*ïS^ñi¦?El´®º UÆ£aQ fýsVájýh.ñ- ¼:u ðµåßwZÞ¶ªÛK9v/(Þë¬vÖ > Únç/¦$,F:õ~ûP<bx¹ÔtÛ¹£xËâ0« rï7 )øúL2}Ç_8Ñ+! 6Ú¸r,j PS¼wåBä-Ë䩾!&Lîj<Ãþ Tå ÉÉÌß¼¶á§Ü`ºg u4¼ßõûÄcÄØ»\m4¶^oo±ï÷á²^ÿ õÀ<2ú-§o%zFmÞP§{vÀ¿Ö Ú ß¾z çDþ±RßCÉGÒF»ß-]â=±ÃwIM¬÷unRΰ 5 Ç>Éõ9ËT«åxÄä ¥ONÚ~2Ò³¤×|ºÈeUÞÊ/;{ÞoRJÈr1yª|õhp#Ûu>õö H°EEÏIÃéøòTÖéF¨ÁÊiØËÉòað,-9W]®;wtätÎ)£Ï#iðûë7ÜtÓÚ=?>2öQ£Æ Ëyº ÞIÞ*ñÜDÙ¾t7r®ùÆ4ªYP9¸ãBÜéøI¼föì¼ÌJ³9ÄZ2¡4ÿ C¯¸îä R^&¾ÒìÀ¡×o¬Zm/r^#ÜO[Xµø5~ yà@!5*i©Ã ´0lJMÛýc ¯J#Û¸¼_ÌÑÏ º p÷Ô©Ö'N>9~¾æ1YëÞ)N Pv8=ÃÀX£ÙÞDö½0þ²xhµk©e³¶^07#XbÐh7ü¯íÁô´UÈ÷¯y@5×m7¾ÿ ÆlY|cf4 #ÞÙ<¡».1c[; û.¶JÒ ¢ñÞ!5 qv£ë\c¡>Ä¿X» JQ,¿úÍ¢ ¨Í-y×;-p⨿î'Ç_`еh»S÷HXB¨ÜfF^À¬|Ðq ½b¥9]|9?N0 ºã§ë&ah"é£wy± ë7C=â#¿¡µveëxûL,Ó¢¿ÆjLº35Þç§N°ôJñGýw«öD`'C£PçwOb ±I >üô ºïTÝ[û"(4ok=zýcâCR´ürÌ J- Pb IÒn`pä!¬ÎÙ"kª éÃÏ go8þ5 Äk`üäÑ©¹ãÓÇÆ5·§<â²°Îf =cÀsÙJig/ýZ(ä$?èaÚòÎ:ÍÂ:ÏÁzÕ°Äwtë$¸´g5È>±/9êúû}-%xswÆ°U5qAäìd{ %wÜ ]»?["¥!VÕ<Që dy?!l ¥U yÎ$¤ §rä: ý®¦ 8´1Á}ººÎ»«¡°ðìÞ'¤@U`½ ]HL¥NFAï¬EeA5wäãúñ5&Æ"i,i,ÙAÅ ©Êù$]Áäo{ØÐ,D_nvN4â²> ΰ Ö \zÍ À"Ĩ/Ê)&×Þ,Hf]ÅIÙ>I¾xÎ_a _ð?¬3ñwè'ßÐË1E HµäÐìÞËf\¿Kô Îc "(¯ Èî c¡#¹ûׯe P;! ÎÄãQÁ!Ä8¨I±#R${íó×ïo8¿×åÁBT-Á£i#¨ÚYa«;?}e ªãÝ`Ð ¸Ðb>qGY -ßÐÀ;Ãq²ö[ ãóÖêb"°ð¼3pT ¢+jﶢ\¥£ã=fí÷8'ÞL,ÒÏûÌ0Ó SÆVh -êÁw®Ù8¸ çIãTï| ¼ã#wDÒ inë®<Í¡Â tþZ5ѳÃRÃG5n@2"pIEÆ£ÂhÝ8ÈÕ·bë}» x[ ©ÖuÖöL V§¿ü ñß*3ã>X;r<Hïdzç; @nqªõà<´åÆ}À|zá© ¡(l£W·Þ ,!¥Dy NN]Ñ }a'Û~þ˶æHÖ¢<®ø1Pízt¥äº\o'è D«v³84óØ4tĺG" UâöÃÖ2 ´\Ópó ` nʶaLà0-þ;d^c®®"Ä*´ èrñtæºÄÒ&¸zæz|Õ]R þ{®3 ¥ÌúÆ¶É ½¥5)°pYº¼`cçpUík?4ßt¦ åè,!¿ß]æë¬! ×nî×ÆRK©¿9fèÉ]*k¼*°u(·_?Ã*HEéÌ#¡Cóɳ ùlÍ7fÙÞÇÍ˽á}0«ã5ia©_ÞPå´Ù'#4[ÛE¸ú´72° t¥uþùÿ J:"p»oø¥ô ¾ lE`ôj¬õ 7Áª6öv ýƼå4ÕÍ?@Inß(õ}G%Ø·½¬LUàÃÏ Þ5 ë- ú ÐwÈw0% {që*al¹E _Éà1GZÅ ºþC .Ø~W÷ôÆKAéáéÇB'# ;Û¹AªäEOkgq/!EËá ñ^¸}%Ãm½F´x©;Î:A®°çæOÞ¨LÂè@pºãN¼¹+jÒhTºp{ãUMìÚx®, X)S¾1ªA%äßâ1l+c ´=ä ظzsqþ1¸÷qu+¦Èæ ÀP\Ð-Q¡uJ¢lãýYN©Ië£Væ<úô©®¶¶ Ä|½õ¨¥Mà;YüÝ~ W-æP] 4ýb<à^u6gÿ Îfhæ¹Ì¶Ú<nÀ¹ lP6 Á®j»¸orgtÏQMÇã7q){lã DÜ°Bð* Ú¸IKÏ /++(½0ÕÈ#ÀA$Ù ò[ã Uâ x¡IÆ+Ë [;U¢¶ÏGY¿-æIÀñn£¬E!"Úç³PÐ%Qj©X:Ö¬ ?"â¼ ix"§ò hógqÆTò"jïÌù`(zÑø »b¼ùPò;0·ñ:Àì á µH-EÑJõ¬x Ar<P[u¢ U ®À º<t»Í§ÍAy¹)6ê÷É R[µèñtE ®Î>1d;^|ÝÉõ\%¨®xÆS!KAB(ÝTÚO BT¢ tÍ ²°âë$d EH«WM¦ÂÞNnßRÄ«½â A®¢#±ÝOç>ÅLQr ÍÈA)OÈã-Àè> ò~ÌwDèZ9äù9Ç÷³\s¶ïÿ q.DL íé@(òh æÆÁG} PÕ¡°Héz"©Yde%ØÊ)| èl=|d¦ÓPHàA!¼ôÅF°ÅAc`ä¶Æ#sE5£½(/63´UÛ5VØò±ÍªÊÃh q¿n1Dj ñÆ ÃùO¡övÃOÑÓYÐâÜÉ~14ÜUC¼¢ÃúHâè%M;óƯ¹r Ø(= 8/Ï£Z< éCN4 m^³dº¼Å(®WX ºÛwÎí¹Á¦MTJåãËç.× ¨ ÂΡkÛhë¼û¡övú÷ú\ÅàøÂÓã$¬QU^71Àë@ Î[äi0ó½ªXKj0)ek¥°ÜÕèuo t&´òíN°µÊ?X¸3Åþcè} 5øú_86¸+ñðs£¬àֿά^®®9·eSN·Ðk7Æq <9âÞ92üèéCedÓß÷0!4bÀoº}37B¾ö 7Á BËUgà±fôpñd F¾>pÌLæûÏä=¸¯ÆhÑ\ Ã:ý?ç+êk Ûæ&÷²z¶ ï«çc ¬ÛÑ!Ð ,cz&æNÚAð <lµE¡Â` ÚÕ ¯ ëÔ5^ñgCy_$@XÊ¢j´d+"Ä$¾$CºR *î$¥<@8a91d `OùϨ¯¬EAg#¥%ÔѮἠM!Ñfü5ïÆ @0Nóå3B¨Ð¨(] PÀ(±ÙJïõ .(ÄÖÑĤé2 7]ÀÔV4./+£k?ïÎ7´@ðÞ Hl ÏbË[= ï'% ¡_8Î\|ÉÓ0/t hJÙ£UQ'븶ØOayÀ Á8 TÞ7 !£.(V¤`fs½Ùh)PTìíºç?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 12426 |
| Response Body - size: 12,426 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ù¬ÄìóÛÏ»)¡¢Øéʧç¢Úêôã,y3e®êÀ &ùcÑ[Kôá¶Z8Û! }cÕêóèÝ$óPLeí0¯ ô3]Gª¦¼ûåëÏqµÅU¼$ÅA1 LNù)öUvèÁ÷ôÜ*Umðwk¶«"$ Ëm6äg©> ô:ÛÄ`bj3ÝOIÄI,D LMNû553ëOW 1ñ¾c?¨KéÀÒ "ÓvÊßdyó-<Ò¡Ç2Õ ½M!²Ç]'Ùêìvj²b 4Æi{tøj(Ñ_¥\Ù_ÐÆxï 0çM¦Þ¥ØcÇ t1Saè6ù¦xµ5Ó¹ÝÕoô¨°Á˵ÝmÖÚ<É«- ÇVjrvký¸oò]lÅ]Ñn.ÑM7×ÚVu}ðqÚùæfÀÉ^A£>Úi¹MzK0äç_dïÏx4ñ7¨ÁíÌ¡ô¹öåcZj»²¸ì"fN«²V²½¬6Fâ¯-AFÜ~ÌÕ]¼GaÕrH"H*H9gMÌÒz|¶Å)8Öפw¹¹o:xÔ9}2_D_GËuºÍ±\ötXã#W»:ãæmbg*¾®3ólnWdÞ&Í *zäÑëtEÙ3Ù³?D§§¼\÷ϤéSo&¹¾ôÞmN?C×I\,ë(ë¹é:|NkÈ㿲'ÕÛ K]¤ßÎù 9P ° ¢`Ó¸I¶¢½FõE³Lê7Ýçubú§/µ¦rs´tÎ4GO ÍÚ(Ó͵î¹ù=fÛOÖçF½Z|ÚÈlë ùñÞ T4LHÔñÕo]ØߥVËèVf2{/=q ³&ÀÓ5}OYÓ_;ÅÜUÙ , &&*@Ð:î»»¯²Îë°²ê,4ßA¯V]~mYÖm/uSzÿ £i}yÓkçÐ ÄM hu XvI=óa6òÖ\1ÌtÓ»>~£qbÜa·ßíë?ÊéR÷J¾§<µé¯´óày´@ PD jlØ ®NC¬ëpbØÄ0ÑHyõ²ùúЬ>3Ú ¼±ãôë{sÕ! ÿÄ ( !"01@$#23ÿÚ £ÍÜÀ¦7b 0ÿ ·Í4¹Úºµ°°E2« (ê tW.Vê×Ó »½Ýª¶£óÿ ´lM_äºßÊD ±P8ïùR,ZU»Î[íÓGæ®Hmö¼E°£;ìÄö¸Z©[õJ[ªo¦ÁOXÿ ß%G@eo´Ú~ÚBF»^^ËÊØy^V¹0÷;áàq¸ö ë¹n6\§µgúÚdÕÇ[v ~ÇU©o^N¤Ù¡î¹°l¼3)¸¤[°«z0ZÇGto¿uf$ÒA±0<c¥_RÛXTºfBÐ"ÊjÄÿ ê6 !ô©} < ]RÃJNkmgÑULëÇ_{Ø%{J.ñÓÒ ÕÄZË|ÓVî?XPé]-[ìzXQ?@_Æ¢ç,ÙßÓ k½Ãt¿k(VZîÃ0ù [}u¡bÜr°PÒvñ«ã3ÝâûK©ú(!_£Ëë{ÜæfQMj´-eõjʱô=rÑÓÿ 8ùt*;ª°¬«w[Ôº ib/O¼B!¡zMùìA~;©HqjÜÊOÈ(%NÙÉ9²e5`rlË8ËQP(êqðê-õnÑ*BÒ®>°Y¬°ÓäN·«v«{-3 nÚдâSÖTô[£¤U ^UbkªÒWÍU ¿÷=ÂqíöXÍgäÃß@böÚj¿«/g}¼¢E^ÍÉ`§9µE +!ñµY* Ú<Ü WKjåMj¡Ãu6tá>{賦åö4RδzÖ. N·îc©¼¼hf&!\w ÆRa(®'"ÜÃØö,᢬½ Î7±ÈtmÑ© &µéqjËòðlÄÄÇÏ@PU,E´&¨¶ÖìX`üb&AúÄ®¥µVÁXºíæg ûãDs]¤¼hõ+)FéÐVµu,zóe¨¢¢>VR"زÆ5³r_óñN6é%öQoGs!\ÅòxßèÇÈ3Y±«Âó(å--~KïøbÔ ½e«°'ãJ¯Ûm[qdäLÌÅ¿ÓgXÙbD´fYYøþö¦YP(þºÒ´ âéð©ú)n+ÏÈù¢ºÕ·{¿ç]¢)[&èÂÕSb CùÖ¬ Z§ä Æ`uÛ·*ÈÊZ±[ñÓ$ÛN&DUdÓZõÉéx+ÓPK5|u²uýAÌVÁÛ32¯,ṉÈöÄ--x]YuléRJ¶&Â±× OÓ ÌÄbhfk¦ÊÄBâ;æm,»`OêØ +BÑY@E3ýË cC ?° T1WÖ¼#Tc{ÊÖ«I)´j?¶'Q¥õ2_(}m+£;ͳó²G¿Yä0ÁÄu×ô꨼«Z0ÁÇÅõ'KVZõf U+Éó ÛllÅlEaãÊÈÃÊYÈ ÿ ÿÄ ! 01@A !PQqÿÚ ?zåWÄ!Ü~£¸ÕnDd%L@ëÕUÌATHÉ#_GBâ`oA9ÑH¤Hï÷NTG!àÿÄ + !1 A"02#3@BQaqðÿÚ ?²¯BDÖÄ Öè3 ö»@ `Ƭ5¸ªÞ×tpÂsÃPîZ OÆÈqâ §LLÅÛ¤hç!Á1ùsé5ù <s©1¸ðFá2KåZש{Òºc% xBýê@¿Zr} dóADÒëMx9¡Ü§ Oð¹Pâ1;&?»PúZµ_¤#ÙH]tâ Å dÿ 6Ið"ö_¨¸xä¯^TÄZYr1²YÚù(äp³JõÔ)G¼ø&c_ "2; ()l¸£ÀñÊ=GÇ'²ßnBؽ&1üé#\';Ð6èXm²¾ÏGǹ )ýQ`§r£:40ò n FPê¯ OÙ[PQ³Ò§kݲlO<T=QoóËLáÖ¥ë+ðPÛwEÓ3þwÆÑNF3YÒéÙÛñ@ >ÒhZk Ôu4h.˺N¥¹ ;V¡¸Ü¾·<ÝÍ$8´÷oûL²àòóet¬n9iÔ´fJé ÅDòéÜ¥ÿÄ 5 !1"A Qa02q@¡ð#BR±$3PÁbÑñÿÚ ?`'7,©, Db×lã !À Lùô*x¢ ê tÝ-®å5¬ÝC¢ChÙé·§#ø (gæ YÖÂúØVÈXÛ ´áTçµWÙuÓ;&0tO1o¨B{ôEÜ!}ð®ÀÑÃR»ê«çKͶ=¢&C5²Õe]½VþA 7Q4Ý7¶È½ÆGeADàplÀ}Ô7Ò6Yo·ÀFØÖMù*fͼªsé) »·¥°1~«ùUmzz@ Ðê«ð`(ájC-A_nª ¤ ,8ÙPHØ"î ½þae-»B´2ýL)/Y¨D* ;vòK¥C¥ÚpÊD â.}Í{yÒ º,7P\á h²*Hò§4\Á.?E' ]Tä"Ý0 q:z "¸ThKã(DswòèQºÅ;?nò ¼H¥º ªâcÕÕN£@³WeUP[ß Ð²ÊÐGUNA;óÐDºÈiB.ײÒkEI(=ßMùOF¡J¢à wB£éÍD wYFÄÀQva9Ä*-MHH üæ6C>ê²7\Ä«¢Ú¹½Óª5 =]w~SË1"Ûî³ô^¬ï0!xMv`îÔDþcæ·é¦ Z&êdy¤P¨vÀÈòZ*A*+8ÜVÁ Àè0 ÆnÊ%xfû{¦æVÐÔn¦þÑk½Â¤ùy`¬¶*]^ÊÈw·*Vfí*´D(BNÖUöó=Pø Ú>ÿ ñiÔ$üÑ@ø0ìôT0zcÿ éÈ5ÂxD$R&ÔÃþ]:)Øvh>\ÚÐÊÎ# æÍþKúpÑ·z(ËkBI lðæFÐK;ï @+ð©¬óõUôìU`# 9jí¬sIÜ(*¶älÀüy§QnÉ¥¦» !tSÞU0ùPíèØC>û#@TÍO=H2Aqý*->B'vÖÖYÌ9WHêJ&¥;;`{]ôV)¢ò©«" íJ¦Ìì´ ¸é2ª+('°øμÓYÝJ§¼¢ V$eÜo®_PDGítØo²Ãfë,Ô_±YÞðÓïÙ5º\rGn%¶ÔL*LtS5PØÉüá§êÀV¨Øa 4n\/K¨{FgöEærØþÕý× ÂÒêBým¾SúøÄ @w ¤´oh£·3¹Yx-êïËû§ ½*5ÍYíÑC 8D»ýÕpÜúØHTÒÙë4DíñÔÀNȹ³â8Ìfõæq dl ý¯p«mþ{å~ú§x¹L8åÓdÊíº¿ø<¤D(seÄsÈ©f}ð-ê³8ú¿ÏùG¿DNßRáq6#uxyræ«t äAtcpi0ziú¦°êâpÌÇê¥Ô4ý~ûã_1Z¨"g Xlp¶YÀ¶©9Nè`ýýº£ Æð»b&]a1)¾ ÃGpáÖñI6EÿÄ ) !1AQaqð @¡±0ÁÑáñÿÚ ?! LªûD¨}\ËÄϬu@ÙÌ·CEcÄDj9ñ®µ æó)h?[¿æ´ _m«Þlö>vtx:üøå tÛ0-e1UCLµô¶²xìídçYÌ7FMÛl¦zb ócÞTp»ÕP ©¡³¨gE£/#ÞV®ÕôýÁ´{O橸X<Ec.äLBç å *¥¥kLzFa © +xî/Ñ]ï=så pTÒ Ë #j¤¾9HÔt&Æ ÔʪîQÐv³C GæpAª´¢¼ÿ ³Æ.íÇMöwÔÐøUÄ $it¶% ç´©Û>!úXÖ' µI ªPû7N¼çæ m®åJÂظ`Öþkñ4úó/´Ø¬ ×õ)phÒ bæ3?`U¾ Ô!MëÀD«0 ù&jëe©º£ôáÑn0%$¸=¨H6Òá²cA·åÀ!à Ë~>T¯Â2¹Ù-7)W¬bGÆZ-kAÌlNÔÙoMçäþ¥t6pØWÎ(@BÈ45éßø¹ ÆàסXµ}=à>)»|bCöBTм_>Ñ°*¥ôò%Ê= æv«óqµÉ¦#§Hïë7 ©gµæcÐ rg'YÀ`ÕeÃþe,b¸.%x=QÀÛ ×ñæi´Üʸ zJ0À/l;èaÌ+Uu:é¸q .ÞëÚsÃqD\T9Ä_ÓÚôÅÜ=YDº.#£bùÍ£Füv; 2ÌòêfbªV¿;Aü5 +ÔÕOºµl<Ç¿HV,¤pé ;±lÛï cõVþ7WS4 çõûÒúþãÃ^0X:#0-G'yê0uS)J·ÏÄÎgwazÎú¤qçΡ-Â> ¸»Jgê#eÜ/ÙÂÌï{¹ûg+`-4ñÇzÉ·GþÂZµáR¼6F^!-Ìæï^²¸t)bËï·¦ipbð[7(»Neì<shÖbgJ^ =! Qz@.#ÙÖ RÌ44çé'j¤ »+RÚ@¾÷@¢¿ÝB-Tmô WMüé ,FÚ·ælÄú,/VS¼5Û+h Ü3Ù¦-ý¦M¡+ïÛ',ºËÙø©Àm"q`gÆ/ ïkm\oúRY2év¥²{EQaïQÚ }IR¥xmÝã ¼@¬BëÑ7 Â@|;&7½<λGàwÂ@ /Æ ºà52N3}7¡L©x9üJ¾\TÄë.Äù?¯)ZE/:è^Rëâ Õ%ÈrËôËmP¦¸ ÌN¶¡Iì¿49GHë×Þ»y»áó[Jà+¼J<Äu? ó D§þJkÎصú ãK<´ Ãbj³t1¢ù*l3q ¹ÊTÔFÅÞÇ´Û§hÓt]G^³}¹Ã»SWxy«ÁÅËÄ eGDJî~¤ºÎ??8§ +wpFT©Bk¿ó ÓÔqwGí3¥Ðño/)na8; ¡8Z ¾[Æ yÀRª?gê(_9õ oôí/.ÊìJhååà¿ Dô¯NÀz¯ÏKÎý'Ï´Á^%;Îs@¡¥_Ñ«°NO䥨ÈigD_²Dpñò»@ÕW|Þ +˦Ç6¼K ×<¦]*ÕgY·?¨ÄËYcÿ &+¥[Þï ±jûËëµg Ô=¹8o=&iP&ñá/"ÿ 0ÏR]ø:óX:[''Ï]j$¨ÇªÉ͸Õò·«\w¼ÃAãßÁr]¤ºq»ã0ïlqs$Õs)"ÑÁ/Ö´uÁTZ~j 9 ÝX.:Ä ´7´Ò³¯Ð;xð(4¦§¦`$;ä8ã´r4J]hÿ -£^.|Jp1é=Ü=ûÆq¨÷¬Æ²ÅÙýN r³ ìDrïñÎq*¶JØË9ôïÿ Xå¾~_´Ê[*,.XÉÑéX( ºÊ7YeÈ·vã;fH¹ëµdê[,?ä¬J ~Å úEËðRÚMÇAò~?QÌÊòÊR¿mºkÚHª+hÎ|þq0Eµ«ö·Úq¶Ý §ï´²âÍãáÇ(«Ûí 5;qV&I´°·}Idp¥Nzôcó8±±mhâ·þ°·zÉÛYÏÙ\¸0bÄÑÌÏ¡ø&º'y°¹9 øKN¿ç]yÅdo÷#E2oê'.¬6Vñ¨qxÝÿ ¬À¥r:Kÿ © BZbï ®îåè7 4 õqÖ 8)¢c£Ï§Ó_6Âh «³ÒdªÌ² 8ô`ûCÀ¡ CdåB ^-â 7AXïðò Û^ÃÛã©ÇE§Ô³pÇUZtÓóÚTùº¹±+m¯ Ô±òVÛí5WfÙí£MúBfiÀ0 ûËN ½ ÿ Ø WKíî8ûqà^à ¥N³¬f{'öÃ5$à»ã¤ÈH ×=åÊ û Ûù0Tlº§ã,¨KÌÁô«]ZýÈá¿ 4Õ5¸·2«_âBä{?<_¥JXg :\$\ Ó?ÇÐ~Ôú@ <¦7Vѽù=%BÃbÁ/÷ è²T 3gþ@µ Ö6ÊÕ~GõPXÏ¥~X÷fpǾcA(ó6uöd< Þ4ªßþO(å £O[¯XR s({j QRúD¾JÖØÄ jÞÃt÷w rr7-Á¹k#Fy~8þ b*û" ´//õ[Îe 7໵²(JØ {`Ó²Uä,uõë¿íJ¨Íeã·] Ä n®x¥®qÔ °`Áå]'9`£½ß,5+ I¾ìÉ@*ê72cÈÑáWøß¼¿@ãABÈXçµÎ'>¼ÏÿÚ ºæ³l,]ïÕví´©Ý^ 7üס" t,)û·×4 Ãÿ üÒ¬g½B°`kúÁrc è þÜ;Â¥ÆUvÐl¯ ³vVçÝC S§gÌÃlt¸ÿ 4ËCÓÌa:]v9ãn$÷ ÿ ücvÁ æ3lÜBå WþÃðskº ,0ÿ ÷¬I=d{JH 0ÿ ú¾RïÎôÚ¼¹ß 0 ÿ ˺yËîNÓ ÿ ú"uÐÂ| ÝýðáÿÄ 1 !0AQa@ÿÚ ?ß[^µhnêÝwR½4½ /ÑÕÆÛ¹/j`jlbCt_£]Qé>îóZIÈÕìº'Àey ó¢ÌÁO/må{a6%YÃ67Ù;ôãL4W!s¥q¢puÛÎzn ÒÆ+Àã N9ínº5!£F%èTüãø¼ ÀèùïCSN »Qô9ÖV%«Q ìÑø2!ÿÄ ' !1AQaqð ¡±ÑñáÁÿÚ ?#j¬wó b 0,¸rɳsæD+3W 8ÆND $0¡Ò³ßË9½ñÃÂQFiæ¼ád4;ûÂÛaëÖ"ÌüÂm_ÙÏ}à¬8T©PÍ þ+¯¨ë. ¦¨G·c/ë8 Äau¿çm7à"JÀàÍb% tÏsa¢Ús×î%<ùH< =<ó³wO¾×õýÏFQØ»@¸6¤b¥@@Òó}ÉtW=cG7 Ê&%¯ÀýÍ"í¦|ÇæÈÛÒ´ûÊÔç3ç0E,MrJ̨ìþ¿Ù´Ú½¼òR妽o¦h÷¤º84\l] ¿~$C9+}ü{K UkFs1½höVþöoZ®ß¾yô´iVöVÕ+y@à à¸3E3üuÇuMûvýÿ ";é¾Á zvéÒ sÒ¥ýv¹BÒ¸ÜQÏKúÔ£Ý ¿iU)]ô ¾Z4í£Bj ¯Ö?>ÌK)Û®J»ïûûQVÛRýų= óm;B§5Êó\¢;BülÞÿ ä 85Àà0 !ÖØW.ÛyPé).6M¿gÜ FûÖÞ3îößß5 ÌRäºÿ à¢õãoä eE ±øõYR¦ W7ÍWñ g&M»ôk¬íæºÁVö©¯½¾%ëèsµÙ}ú_㧩¦`ë]ØíéÒ$Gh- Ðô HCÑuKÆSØß±!wPùÎm¼Ö[Uñ®oÄâ H@!Ì|ðP5 ÝñÅüÔGÚÆ5$§ a×è¸; 3¶æÿÄ ( !1AQaq 0¡±ÁðÑáñÿÚ ?ÚYPÙ¼lÈ jðoÏX1 ¬LÀÅ$ÕV¸ x[Ô ¶uo>'^v Ã8}<ËA%J»tÇ]eeDÖ¥i×ù}F0ìµA£nä ôcüf$u Yf'PÖK'è.ÍÜ?wle(6GV骱 ñLº%kÉnøÀr*PTzeN&¯3fÌ58U6 ÷mjÓ¬Þ£b°ï^Ì V)øúh_4Pp;+ z8!º<%ÓÓ8wT2ûøÈY¡#¢S7åï;¸V¬XZ¤Þ_¬ %ì+=d"2ÄHôäÛvëTnH¨ zÁ,iÁ°s¯zÎ0¸ðF×ÊWß {>*¸ãô~ãêa "v C g9]ó5oü8»pè4ÕìáìërG èQß06{Ît`jÐ÷mípä(vd 4o 9\UÓ4üÌ£qÛê³ ~ S*µþ=?³V&%¾ñ)Ü´Üî»ø2o1ªTlô¯Þ!J4§þ¸Uðæ5bk ¥Icw¾g? è 9`x{ÊÝ0Z ¯i½ ÒÆrkTx5®²C ¦×jûUüãöLIö/øA¶¼»õa|SJ#^ß4qpM²A¶ñKùpaF]êU/Å µT,Ö°kte ÁhWnÄpAàßå¸Úb×ÎsGé1 Qj÷Ï÷ÞZª"³e rJþMZÆUOA>²Q[\8ö =æµÇÄ6Æ"+ íw0ÕB¨xXW ô¤"N NÞÜXÐ WÄØ·ÆÆ´øåÈõ xçüc )])Èòõñ?ÊaÇ@ +ý×Æ/ç¡®ü.0e£ å´!(¤nù·úÈ-ì'-øÖÞ t0ðý §qå¾a`M#íÌ ì!Ý-ÿ [nW£A w ¸ ¢+羡£° ´0âHqçMV"¡Rñÿ ÃKªÉÐS7nÓ¡ûh<,G8ÕødµUÄmú?Ê} XÄ ¾WGÎVÊÅ9X|±Àv&áf÷§ûÀ¹1¤5Tä&ÔBLQèk[É@çQe_FPï9sêEUZý3°Çÿ ¹Jg6Më"u¾v£Ú(ä]¸ä ¥¯A S`=å±7iç }'ÒdûÏ¡ôçhñBÐ:ï &È8Ø ó øGâ"+¶í¨SxÓrÖºZ s b*ïS^ñi¦?El´®º UÆ£aQ fýsVájýh.ñ- ¼:u ðµåßwZÞ¶ªÛK9v/(Þë¬vÖ > Únç/¦$,F:õ~ûP<bx¹ÔtÛ¹£xËâ0« rï7 )øúL2}Ç_8Ñ+! 6Ú¸r,j PS¼wåBä-Ë䩾!&Lîj<Ãþ Tå ÉÉÌß¼¶á§Ü`ºg u4¼ßõûÄcÄØ»\m4¶^oo±ï÷á²^ÿ õÀ<2ú-§o%zFmÞP§{vÀ¿Ö Ú ß¾z çDþ±RßCÉGÒF»ß-]â=±ÃwIM¬÷unRΰ 5 Ç>Éõ9ËT«åxÄä ¥ONÚ~2Ò³¤×|ºÈeUÞÊ/;{ÞoRJÈr1yª|õhp#Ûu>õö H°EEÏIÃéøòTÖéF¨ÁÊiØËÉòað,-9W]®;wtätÎ)£Ï#iðûë7ÜtÓÚ=?>2öQ£Æ Ëyº ÞIÞ*ñÜDÙ¾t7r®ùÆ4ªYP9¸ãBÜéøI¼föì¼ÌJ³9ÄZ2¡4ÿ C¯¸îä R^&¾ÒìÀ¡×o¬Zm/r^#ÜO[Xµø5~ yà@!5*i©Ã ´0lJMÛýc ¯J#Û¸¼_ÌÑÏ º p÷Ô©Ö'N>9~¾æ1YëÞ)N Pv8=ÃÀX£ÙÞDö½0þ²xhµk©e³¶^07#XbÐh7ü¯íÁô´UÈ÷¯y@5×m7¾ÿ ÆlY|cf4 #ÞÙ<¡».1c[; û.¶JÒ ¢ñÞ!5 qv£ë\c¡>Ä¿X» JQ,¿úÍ¢ ¨Í-y×;-p⨿î'Ç_`еh»S÷HXB¨ÜfF^À¬|Ðq ½b¥9]|9?N0 ºã§ë&ah"é£wy± ë7C=â#¿¡µveëxûL,Ó¢¿ÆjLº35Þç§N°ôJñGýw«öD`'C£PçwOb ±I >üô ºïTÝ[û"(4ok=zýcâCR´ürÌ J- Pb IÒn`pä!¬ÎÙ"kª éÃÏ go8þ5 Äk`üäÑ©¹ãÓÇÆ5·§<â²°Îf =cÀsÙJig/ýZ(ä$?èaÚòÎ:ÍÂ:ÏÁzÕ°Äwtë$¸´g5È>±/9êúû}-%xswÆ°U5qAäìd{ %wÜ ]»?["¥!VÕ<Që dy?!l ¥U yÎ$¤ §rä: ý®¦ 8´1Á}ººÎ»«¡°ðìÞ'¤@U`½ ]HL¥NFAï¬EeA5wäãúñ5&Æ"i,i,ÙAÅ ©Êù$]Áäo{ØÐ,D_nvN4â²> ΰ Ö \zÍ À"Ĩ/Ê)&×Þ,Hf]ÅIÙ>I¾xÎ_a _ð?¬3ñwè'ßÐË1E HµäÐìÞËf\¿Kô Îc "(¯ Èî c¡#¹ûׯe P;! ÎÄãQÁ!Ä8¨I±#R${íó×ïo8¿×åÁBT-Á£i#¨ÚYa«;?}e ªãÝ`Ð ¸Ðb>qGY -ßÐÀ;Ãq²ö[ ãóÖêb"°ð¼3pT ¢+jﶢ\¥£ã=fí÷8'ÞL,ÒÏûÌ0Ó SÆVh -êÁw®Ù8¸ çIãTï| ¼ã#wDÒ inë®<Í¡Â tþZ5ѳÃRÃG5n@2"pIEÆ£ÂhÝ8ÈÕ·bë}» x[ ©ÖuÖöL V§¿ü ñß*3ã>X;r<Hïdzç; @nqªõà<´åÆ}À|zá© ¡(l£W·Þ ,!¥Dy NN]Ñ }a'Û~þ˶æHÖ¢<®ø1Pízt¥äº\o'è D«v³84óØ4tĺG" UâöÃÖ2 ´\Ópó ` nʶaLà0-þ;d^c®®"Ä*´ èrñtæºÄÒ&¸zæz|Õ]R þ{®3 ¥ÌúÆ¶É ½¥5)°pYº¼`cçpUík?4ßt¦ åè,!¿ß]æë¬! ×nî×ÆRK©¿9fèÉ]*k¼*°u(·_?Ã*HEéÌ#¡Cóɳ ùlÍ7fÙÞÇÍ˽á}0«ã5ia©_ÞPå´Ù'#4[ÛE¸ú´72° t¥uþùÿ J:"p»oø¥ô ¾ lE`ôj¬õ 7Áª6öv ýƼå4ÕÍ?@Inß(õ}G%Ø·½¬LUàÃÏ Þ5 ë- ú ÐwÈw0% {që*al¹E _Éà1GZÅ ºþC .Ø~W÷ôÆKAéáéÇB'# ;Û¹AªäEOkgq/!EËá ñ^¸}%Ãm½F´x©;Î:A®°çæOÞ¨LÂè@pºãN¼¹+jÒhTºp{ãUMìÚx®, X)S¾1ªA%äßâ1l+c ´=ä ظzsqþ1¸÷qu+¦Èæ ÀP\Ð-Q¡uJ¢lãýYN©Ië£Væ<úô©®¶¶ Ä|½õ¨¥Mà;YüÝ~ W-æP] 4ýb<à^u6gÿ Îfhæ¹Ì¶Ú<nÀ¹ lP6 Á®j»¸orgtÏQMÇã7q){lã DÜ°Bð* Ú¸IKÏ /++(½0ÕÈ#ÀA$Ù ò[ã Uâ x¡IÆ+Ë [;U¢¶ÏGY¿-æIÀñn£¬E!"Úç³PÐ%Qj©X:Ö¬ ?"â¼ ix"§ò hógqÆTò"jïÌù`(zÑø »b¼ùPò;0·ñ:Àì á µH-EÑJõ¬x Ar<P[u¢ U ®À º<t»Í§ÍAy¹)6ê÷É R[µèñtE ®Î>1d;^|ÝÉõ\%¨®xÆS!KAB(ÝTÚO BT¢ tÍ ²°âë$d EH«WM¦ÂÞNnßRÄ«½â A®¢#±ÝOç>ÅLQr ÍÈA)OÈã-Àè> ò~ÌwDèZ9äù9Ç÷³\s¶ïÿ q.DL íé@(òh æÆÁG} PÕ¡°Héz"©Yde%ØÊ)| èl=|d¦ÓPHàA!¼ôÅF°ÅAc`ä¶Æ#sE5£½(/63´UÛ5VØò±ÍªÊÃh q¿n1Dj ñÆ ÃùO¡övÃOÑÓYÐâÜÉ~14ÜUC¼¢ÃúHâè%M;óƯ¹r Ø(= 8/Ï£Z< éCN4 m^³dº¼Å(®WX ºÛwÎí¹Á¦MTJåãËç.× ¨ ÂΡkÛhë¼û¡övú÷ú\ÅàøÂÓã$¬QU^71Àë@ Î[äi0ó½ªXKj0)ek¥°ÜÕèuo t&´òíN°µÊ?X¸3Åþcè} 5øú_86¸+ñðs£¬àֿά^®®9·eSN·Ðk7Æq <9âÞ92üèéCedÓß÷0!4bÀoº}37B¾ö 7Á BËUgà±fôpñd F¾>pÌLæûÏä=¸¯ÆhÑ\ Ã:ý?ç+êk Ûæ&÷²z¶ ï«çc ¬ÛÑ!Ð ,cz&æNÚAð <lµE¡Â` ÚÕ ¯ ëÔ5^ñgCy_$@XÊ¢j´d+"Ä$¾$CºR *î$¥<@8a91d `OùϨ¯¬EAg#¥%ÔѮἠM!Ñfü5ïÆ @0Nóå3B¨Ð¨(] PÀ(±ÙJïõ .(ÄÖÑĤé2 7]ÀÔV4./+£k?ïÎ7´@ðÞ Hl ÏbË[= ï'% ¡_8Î\|ÉÓ0/t hJÙ£UQ'븶ØOayÀ Á8 TÞ7 !£.(V¤`fs½Ùh)PTìíºç?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 3324 |
| Response Body - size: 3,324 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ø#»)Ó\ùÎMI¸± ©b@ Õ¼äT½y÷éäã¼ó×#=ÒÉ`h X©`PP T× .5ß~.|ºc=ó5w¤Ô@ ©¨±A@Ø×¥¸YY½¹véäãã=àÏ\¬É P X©uW\åV㧣ÍׯÏÇ-ã ¼¬Çvum(ËRj ×.Zó×£^>YÇ«+3Ö,Y-EX éuzxòÑ%¶ó½¹uéãáÌz±ÌõËRo"tËRj "©dÐËQb±} xë·Íé5×~Lsöù·Ã='f|·®§N ý¼W¼ùû3N~¸&äÑr²h §~¿/^¿;´áùý]xóëóç8ý?WYku S#=É P$ÑrÔ@ :Yzy5so-k7\{C§Lzä³=³,Ïi5ô&@)rÒ\µ´Í¢RÀN~[f®-× ×¯Öy{¦uön ¹4k+&*X¢( PH¢*ÍÚßZ¼Úé®<µwÃ{ÌwóÍç³3IÓ3I¬©¨£-ÉpѬµ%#K#[¸âÒo*-"®zS§¢òïè= !N¿2yÎ_OO?×C=@ATN¼MqçìPéÔïó|ù8ý RçÿÄ # P1! 02@B"ÿÚ ¯4ìò4ívM;piÆ)Æ)§ù¦ ?`;h ë8¡E±¦Ý~T' ! t )ò4(ÜþÏï´p\¸MâVåä ï AÐ9®î 6äÓµ;4Íø§ju8NÍ$-¼ìíQ ¸íÝbòA©Í^)ñ×ã²ÐÞ; ÿÄ & ! 0A#1"CaÿÚ ?ÚÉKdeeùY~÷ÔI(´bô_¡³S\{1ª] eé²üÌï¢ ×c{6j"ÛéºB÷ílÍmª#ºÞËô¹ör òDd) ['çe^Ù!d²Ê ù3¹ÆÌÙ£ ØóÔm5< )>ä-¬¿S50ÕDû~+¢ZyåÉrø#1K ¿Â;-ì¿;É#û¡! dül²Ëðd?·½¬²Ë,²Ë,²ÆÉg_£ä#~²ÄË,S²Ë,±ä§EY{I¥OÉ÷3ú6ùü{Y 6¬F#ìL²ÆÌÙd²¤EXÙÿÄ " @!01QABaÿÚ ?ê¤Pôà=8N#Óô(S¤|h¦(×Á(Ð-ä9 ç~ "â©t¾5>ºj%8-ÊÓ$CÑj'ë"jÅ+qÿÄ !P`p1 @QÑÿÚ ?êR*лBñ0E8íÌÊ&£ÿÄ $ ! 10@APQaqÁÑÿÚ ?!õÈZ?Oq99Ò! ¼\úE¢ G>F?BµBæÃaú$-#ôÈxücïVÕ^LÌKÈö>ímB?ÐÇésï|cÑí}äØY* ¡4 r2HM·GÓ@Ú,CX _dÝ¡§¿ôh¡4&ð+Xai¾F=ÓµBêá^<} 3Â~*àf¼®CéÎÉ Ú#£e0È Vu¦Z¡â3÷>¬&øMËTr3l$=_~µGØÉÈz½ ³ºZ£Ìz½ó·"d>¤'F¡6!#Xçá 22M ɺ¥ñ¶¤q~µ&ôBa¿àl£rÿ "þ¾aí£ÀÕh!4 $(kXM!ÿÚ ÷Äy}}÷ß_ëï¾ûï¾ Uè½÷ß}öÎÿ ûï¾IÀp2÷ß}÷ß}{o¾î@wß}÷ß}÷Û>H_5@C }÷ß}÷ß}ÏB²` ¶Ãß}÷ß}ñ.)ù bOnt`- @ G®lÝ~8q ´é¦' úðA.(°Â{ïcg 1Î8°Õ÷°Þ/v{æÚ¼Û}Hã¾à\wÇ à øuà ÿÄ ' !1AQ 0a±q¡ÁÑðñÿÚ ?º°Ä?P±EÄ MÇ4Áë8séweÈø~b#ºÑuìèY×CÉùÚM}¡H½A67øæY%AÄeí®%Îócyíd9ZdögsA¶ÊslA9¼¬¶Zq°³þËûìá<b`mlï¹S¯ïÑ>Æ >צÊ~ÿ Á.?¤ ±áäù8°x8ÜñãþÃhZëÂ}G{bÀqäçëli9u¦N}zùʺ.g¼¶»/ñ-§cÎ Â5ñ°°°°±øØÈ.N?d-;ÃcbGÁÓÑ(¸I*Éð¸q;,ö»¹ÿ |I K jvV%ÝYe-ÿÄ ! 01a@QÿÚ ?ã- ,÷,£ xOà [Ôõîx}ÄG¿ëÈ8 ÙwfyÏid ð<å§ ©$³óË,³ P×Rã &Ëñ ê<e¢ì»ÝÉìGöxyË<ò"jË3ÂxåYàE±s²Ë,²Ë,²È%úq¯ìIe2Ë,eYÀÃ'N2 äEu%A9,YÿÄ % !1 AQa0@q¡ðÁÑÿÚ ?è XæQä©_P2.9K%8KùjWÑ èÐYtª¯po8e/ç©_(W@ï °á±ØÕÆWxòÇNRþDøºþcV¬Ú2ÙuïÐF¥|bðs9KèlÞÉÍÝÇ z¾JzÂÞï{þæñã㬿Z¥9 Q"WôÙpn=ò/¡/ìÈ@¶3? Ð E¶ç(óOB_× òÞvË{uÝ Ùçòt¥Ä¯®nÈ[zÿ ÙÍÌ&G~¤õÎGxÓÞßòsÀ§ _u*T§ç Ry`§AÍÿ Äq+ ¯R¥J~ ½®,æT _¸GF bøq/Ò¢T©N$ SBFEÖËÔU¨ÍÁÍw7>Òlô\Z X£Ë(rmg(¸õH©Øò1Ö÷4$±¶*hâ-½wÜ8C«|héÐv+`vî_Ô©µÑDSzQ>Áç8#вûËðvæÚ4·eØSëqÇ·ñ-óÚ& ®hdç cËêAú\ íBÏháTnÚÊw4\¾|KûV8ؾaÕYÜ<¹N´¸øD¯¸N`źRébß·¬V,]\xÀÝô%|(ÓNêç²hT¿Qàºþç'3BWBWÇD£Ä£ÇÀåÉ»ªªwsû;°ó9ôý Éïaà²( X);䣨ó|¥e.(é©R¥R¥J*T©D£ À `d¸Åx"DÂWæRºp´§Ç]\´´§ÇP, ÀA¹{àææP&Ã!Ä;9¼î&b±D©D¨«fËþbf[ 1c (%Û}âTKÂØ d0 `ÜEm^¡¨EÖøº^»* îR"Kj£5¸ã)c )4âP7 ¥¥½qþ©²>¥JÒzAªîZ£ÍͽJ¡ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 3324 |
| Response Body - size: 3,324 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ø#»)Ó\ùÎMI¸± ©b@ Õ¼äT½y÷éäã¼ó×#=ÒÉ`h X©`PP T× .5ß~.|ºc=ó5w¤Ô@ ©¨±A@Ø×¥¸YY½¹véäãã=àÏ\¬É P X©uW\åV㧣ÍׯÏÇ-ã ¼¬Çvum(ËRj ×.Zó×£^>YÇ«+3Ö,Y-EX éuzxòÑ%¶ó½¹uéãáÌz±ÌõËRo"tËRj "©dÐËQb±} xë·Íé5×~Lsöù·Ã='f|·®§N ý¼W¼ùû3N~¸&äÑr²h §~¿/^¿;´áùý]xóëóç8ý?WYku S#=É P$ÑrÔ@ :Yzy5so-k7\{C§Lzä³=³,Ïi5ô&@)rÒ\µ´Í¢RÀN~[f®-× ×¯Öy{¦uön ¹4k+&*X¢( PH¢*ÍÚßZ¼Úé®<µwÃ{ÌwóÍç³3IÓ3I¬©¨£-ÉpѬµ%#K#[¸âÒo*-"®zS§¢òïè= !N¿2yÎ_OO?×C=@ATN¼MqçìPéÔïó|ù8ý RçÿÄ # P1! 02@B"ÿÚ ¯4ìò4ívM;piÆ)Æ)§ù¦ ?`;h ë8¡E±¦Ý~T' ! t )ò4(ÜþÏï´p\¸MâVåä ï AÐ9®î 6äÓµ;4Íø§ju8NÍ$-¼ìíQ ¸íÝbòA©Í^)ñ×ã²ÐÞ; ÿÄ & ! 0A#1"CaÿÚ ?ÚÉKdeeùY~÷ÔI(´bô_¡³S\{1ª] eé²üÌï¢ ×c{6j"ÛéºB÷ílÍmª#ºÞËô¹ör òDd) ['çe^Ù!d²Ê ù3¹ÆÌÙ£ ØóÔm5< )>ä-¬¿S50ÕDû~+¢ZyåÉrø#1K ¿Â;-ì¿;É#û¡! dül²Ëðd?·½¬²Ë,²Ë,²ÆÉg_£ä#~²ÄË,S²Ë,±ä§EY{I¥OÉ÷3ú6ùü{Y 6¬F#ìL²ÆÌÙd²¤EXÙÿÄ " @!01QABaÿÚ ?ê¤Pôà=8N#Óô(S¤|h¦(×Á(Ð-ä9 ç~ "â©t¾5>ºj%8-ÊÓ$CÑj'ë"jÅ+qÿÄ !P`p1 @QÑÿÚ ?êR*лBñ0E8íÌÊ&£ÿÄ $ ! 10@APQaqÁÑÿÚ ?!õÈZ?Oq99Ò! ¼\úE¢ G>F?BµBæÃaú$-#ôÈxücïVÕ^LÌKÈö>ímB?ÐÇésï|cÑí}äØY* ¡4 r2HM·GÓ@Ú,CX _dÝ¡§¿ôh¡4&ð+Xai¾F=ÓµBêá^<} 3Â~*àf¼®CéÎÉ Ú#£e0È Vu¦Z¡â3÷>¬&øMËTr3l$=_~µGØÉÈz½ ³ºZ£Ìz½ó·"d>¤'F¡6!#Xçá 22M ɺ¥ñ¶¤q~µ&ôBa¿àl£rÿ "þ¾aí£ÀÕh!4 $(kXM!ÿÚ ÷Äy}}÷ß_ëï¾ûï¾ Uè½÷ß}öÎÿ ûï¾IÀp2÷ß}÷ß}{o¾î@wß}÷ß}÷Û>H_5@C }÷ß}÷ß}ÏB²` ¶Ãß}÷ß}ñ.)ù bOnt`- @ G®lÝ~8q ´é¦' úðA.(°Â{ïcg 1Î8°Õ÷°Þ/v{æÚ¼Û}Hã¾à\wÇ à øuà ÿÄ ' !1AQ 0a±q¡ÁÑðñÿÚ ?º°Ä?P±EÄ MÇ4Áë8séweÈø~b#ºÑuìèY×CÉùÚM}¡H½A67øæY%AÄeí®%Îócyíd9ZdögsA¶ÊslA9¼¬¶Zq°³þËûìá<b`mlï¹S¯ïÑ>Æ >צÊ~ÿ Á.?¤ ±áäù8°x8ÜñãþÃhZëÂ}G{bÀqäçëli9u¦N}zùʺ.g¼¶»/ñ-§cÎ Â5ñ°°°°±øØÈ.N?d-;ÃcbGÁÓÑ(¸I*Éð¸q;,ö»¹ÿ |I K jvV%ÝYe-ÿÄ ! 01a@QÿÚ ?ã- ,÷,£ xOà [Ôõîx}ÄG¿ëÈ8 ÙwfyÏid ð<å§ ©$³óË,³ P×Rã &Ëñ ê<e¢ì»ÝÉìGöxyË<ò"jË3ÂxåYàE±s²Ë,²Ë,²È%úq¯ìIe2Ë,eYÀÃ'N2 äEu%A9,YÿÄ % !1 AQa0@q¡ðÁÑÿÚ ?è XæQä©_P2.9K%8KùjWÑ èÐYtª¯po8e/ç©_(W@ï °á±ØÕÆWxòÇNRþDøºþcV¬Ú2ÙuïÐF¥|bðs9KèlÞÉÍÝÇ z¾JzÂÞï{þæñã㬿Z¥9 Q"WôÙpn=ò/¡/ìÈ@¶3? Ð E¶ç(óOB_× òÞvË{uÝ Ùçòt¥Ä¯®nÈ[zÿ ÙÍÌ&G~¤õÎGxÓÞßòsÀ§ _u*T§ç Ry`§AÍÿ Äq+ ¯R¥J~ ½®,æT _¸GF bøq/Ò¢T©N$ SBFEÖËÔU¨ÍÁÍw7>Òlô\Z X£Ë(rmg(¸õH©Øò1Ö÷4$±¶*hâ-½wÜ8C«|héÐv+`vî_Ô©µÑDSzQ>Áç8#вûËðvæÚ4·eØSëqÇ·ñ-óÚ& ®hdç cËêAú\ íBÏháTnÚÊw4\¾|KûV8ؾaÕYÜ<¹N´¸øD¯¸N`źRébß·¬V,]\xÀÝô%|(ÓNêç²hT¿Qàºþç'3BWBWÇD£Ä£ÇÀåÉ»ªªwsû;°ó9ôý Éïaà²( X);䣨ó|¥e.(é©R¥R¥J*T©D£ À `d¸Åx"DÂWæRºp´§Ç]\´´§ÇP, ÀA¹{àææP&Ã!Ä;9¼î&b±D©D¨«fËþbf[ 1c (%Û}âTKÂØ d0 `ÜEm^¡¨EÖøº^»* îR"Kj£5¸ã)c )4âP7 ¥¥½qþ©²>¥JÒzAªîZ£ÍͽJ¡ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 9692 |
| Response Body - size: 9,692 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ôímm°Æa:YÆã[jP<½ TÄd MS$ 9=Ï;èîè°[Åvî}[çþ¡XgêñºUûy;¡ ±V jÀÏz!èúnk£KÇ?râv96ÕÓy^Uãϵ§³ÒN·3uÈíåÁ±å)ÈÃ-ìß0ôöÚ>¾)Ò+hÃÖÀ Á |££ ¿-ô¯È·ê¶~Ìåu´v°Fî¥å^¾ÞÔ:Ójr·ÕDùn_Íú>}G÷Uºìþ«³©ïÒaÍClz"ES F`>X´÷|"Ñú´Ç=ßIâ³k{}b¶y,8ó× {ñz¼»ZöK.«+>½^{½£º¶ÀDT£(LUhËenóV&¥â'sG±ñí|þ?8ôÔ=-.¿·8Rê®q1å= gè q2ñ:þѪ±5 ËÇwÉ &¶2DÄÆ(º'kÖxêl}ÞË ÏgÎú½<éñó÷7Ä=§%/¯ÅÅ¿ö/ûvssöõZ¸zH |¼w| M¦<£Ó³ôÏ}:w -6xígÌçÁ©µ]óôΦ£ïñô(¬ëzÞ·r+jáê |¼w| Qj¦ÍXËÓ>mÑÒ÷úf çæ.4¶nÉ>wo õLeYiDÛ §+[±]»cËÏ\Ôy{ Ë×w|XU"@ dF½vð'ÔzýÓ¡IäTØÎj_¬ç 1åÇ*jí5ö:õ¶9Ô >àó!Þr $ÅТⶪ¾+V&½^^<3úN_5ë9®6|Y::B+d¥k+n föÜ åÚ¶¬d 2 ç" ¤ÄJÕêü¬xúýÚÑF+ KÆ>§¶·fc¼áî¡ÈAÞr0 T+cÒ>MC?>öáÈÜãÆz¹]3&×6|½nÙy ©±ÿÄ ' !@ 01P"#3ÿÚ þBl)ÿ VX&{¿Á%ãâå× r0« 8ѹg6FØ´=þO?¼èï(ðr Ç!§ÌN?ëS9nB i3ýébgÖ·`áãc[˶ùÙWFÒ²°Ö°/×mÄ éïQÃÕÊ¢a ñÞÚYS«¯)Èsâü a²U^<iîm ©Í>ìé2¦ «#kc ¥|Ì© ÿ y¯x¦ 1¹§Õì%ÖÔ×Ô6ú¼g-V'U G¦Ét2Q2Í:Sêý Ï9w÷ÔNq#ÙYTá1êÄaî°dlº8˯h ¦Ns űîÄq=l JuR©{g*:U¬V´» à"7þB";Ê×®~¼b§5N®«¨åÇE QÄá9Y<3×?^3ã+Ze|UÐÄ¢]ÅMB;JB ñ&+¯vVV<f##z]W}Æ@®G$rk¬È1P9ÉF2&_çtQªKmO²ëIöe¨0½ ÅÇ §ïkO±Ç ˶Î÷p$HCÚ9¡BÔ¥õ ´Þý±I°êõ^2Ø; ÑÙÚÔHôÄ3 ¿<[g 48ÃL4Ö¥ç<ûAÓí É.2eÓ"q'¦>IyÎïBë¡6ßò£!/g¨?ãXK»¦.>dëø: jáÐ=3ã4«g£iÎ+y1êqÚad¯ËÇã$0âäVʯî¨F¡h ð#~7TÚUuöÕì 'Ôö2©ëCaÜü©ÈðÔ=³±£ÜáÇñö-Êbë{£QÔ:ÚÅý9Ï')$Lÿ N±òc/8NsIü\z'ðR» ø2^¿FH#)È]cëõçËgÊåÜêßÿÄ ' !01 "2A#QBÿÚ ?k¹ (gÉCüzGs BAÈÿ pð³¾PÊdlÕ¾V4ûpM«ëjûxþÓÊlí®h%¡Ç¦!©}pÉZíÊtÚ·dÜ×LuúPêLË×Ê2Ç;tþ©qÝXæ¡oÙ\RÍpÂVFv«MÈtÏåÔ£uèqM?j7¸ ýû_èpzâ|o¨ôZµ~L°ð£ÎÊÌP$oY ¢6ò Él_v<±<5Ü· ßzl;üÇi Ë í¨&e´»í1Û6Ðîô(æ hÈ)eL5Uù ¢ô8qwPÉ«k^ +2]¨èÙ^ßF%Õ%¶{ ¬<ù*YÆlòë¹u0¨¯Q}æXúÉ8jk®$[AôRÍ ÖØϤ0 0ÁC ï°Òp£J6ÁÀ(ïòk0hXs¾GºÿÄ - !10Aa"#2@Qq¡±ðñÿÚ ?e(pÞ [>Ë ¦¯êû +HFcr(åõ% ±´]ivØ~&³Lkl ÀýýøÐ03ë8Qâ¢fqL L{*u«y] Kqø]iNÞ±Þ[ qÊÒÞõ4÷iªGi§Õ×püÄGÈ1Û;xpå&ål¼r I^½8ÁóJ)î&¢õXéÊpÂf°;NfsÞÌ]æ¼bÜg>}Úd¼|b]ÂÙOÂv>Å¥/Þ2ç6¾e:[/Ý&<ûôU]¹ï*êWð¾þó[ÂÞuywM °´Ø¡Ð @ì72î ÕGlG^V+çqAóc!z ó:JàúM~µ%Saaçktýd÷jÎ!¸ ÛiºkÔnæ¬úĴ驦þ%C½¼î%¤ÇÌYM-kòA² <ÍoIPFÒÜ<½¼ç@ãjÃÕycü@Üà4ågÔ ¿×ï×ì/¡n\4Ò;)4[Ü ^©tëï.´ÚÜÇìm@Ãõ+nd e5ÏRØûËXtà¿öp¥¯Ó%5©_ÿÄ 7 !1A "2@QaBPq¡#R03brÁÑð±áÿÚ ?ò°¹@þ%´PQúäHuÓ/1K¹:e¡IТ¥A¤zAZÙ(÷&áPðöò Î(xF¾[^ÆZâRJÀ(Ú°ÁE=ý`KJ08Á74|<íS< ji ]HQé Öð¶_= !Sj,á4à=t®K+ýßÇIûÃ%¶\¹)IÉI ÌKSu{»E& 3dðÊUG«BÀg}½¸Ü4çë¡u$ ¾ 4Âì-o8Æáb¢Ú,ºé½G÷1@Ë·.[zYÅ LÏ£Lµ s®MÛaXXF+>NAV³ÚñòÐ¥zF$LS1` ÓfIÎU«½ÿ ó,£pØÁ×åw1Z5ߤ @¬b ³ËDáá·á¶8h3r`÷¾Ä"YÌáW1+ôSóIùÝÂøBj÷±¼]Èg¤GÄk+·Aí8c0º¾o«ó5£?Ö ©ÿ ·Ù3$U{_.Üêf¦ívxJÒx²ïÒ bÀ[ÚÝZ)H`,Ê&¤üáÄ}ÿ ç=\µR®°Ó/¶ h©hÆ@dʦ.PDÁ¸àñ¾Amäô9zB¬¡`ï$^±-U?wÇ( H§ðì.®ÏÚàÂ/ P ºÃ %Ûêç¬îRp ,íï4eÛMV$ÁÔÒ¦U%ËB åhrÄRÊõkh©xEqø¡:ºÕf=K8¦) ßËYo¤áE=úÊ>Vó i¾lç KB źèJÓKÀ[ÜdѾïùÄë%#©û ³ UcÛ- ¾' 9g¹0Jæ2çv ±ÐTCþX/kµô6pªC¨u´o¾zt TÆ÷ÄnþV 44¸ÇEpXà}^Þº³Ä#äIñ0ºÚ \G /-5tÉ¡(\}æp¥)ag·¡ ØQá6TWR0}Õ8Ifký;TÌp|%ðÓ2ei6-CÕ( Ä»õÒV²ÉÀ©zÆñ¶;iJ娽Êý¡+ÂyÄ8¤¼¬i7Ä! EH^0ÉÀa¶ Þ¬ &â)w ÌÜé¿»W´Tà¤àÝ"Cârïö Ïáÿ ánüy¥¯¸h|ãr<4m)),ªmLåT±wòKĬò¥9¶Ë$zGŪ\ÊZ¾¾E©\g<MýS{un@ IÂÖ V ñþIªÀøWüà bðuööýàXR* `3©R4'P PÖSr=`TèúÄE|$_ "XJ %gLCätÿ ÿÄ * !1AQaq ¡ð0@±ÁÑñáPÿÚ ?!ÿ ȲM°Ú?§¤Ç¶/θ9h¶>Fx?AûEF[³À´!uö¦º]y¢ Ò¬"»w' ç:ûhÞ,Y:«·2°7O¹}h&ÿ ÃCkzl´æ Iÿ ?åMº zÉ [XóPRË"àÙú8$sr?Ö&Yj ñ¼y¿-Og°÷úqö/näÓ Ùà M±¿XqcuÃÇo4qE)ο¾áK\Û Ýß ÄÖØ>Z6ÖÞÜ pT :üBC\~êÚõyRq~«êM@ÞòB=êä,ÜYKãõPL8X÷mV Av¦úi§½¾ÖÁ2Î DI{ÌAóY"*b]'{eÿ "Yr ÛþkVªtÍ*ÁN-ùßJ´[Íã=·èÖÏØ~iß ÕÈò>;ÐáÂmÆ>ê3MÌ Nç:. ÈÔåÞÄ»TÈ%Ç ÂEC3¬_ü]Ù24Ò©CAxÕüµ5³u¶úR¥¡¨,!# ©zµb&!³þ&HXö©©B- ÆþjrªÊ¯éY±Q"`þ=õÅwôÇÑ}IÀU9p¬É¥E¥0/ÄüjB&¢a¸Àérü¹.áÍ°üÖX|¸T;°²Bû Y|ÓIAVðM IfRI:SÖ¶ÿ å¾Öí9æïZH&É4n»3hY³Ö-ü«Ul¬½_Sõ¡¨©ZàôY eèvµYÿ fÑ=cZ)qÖ-Xæ à üÊã&1:ÁóÓ1Mùµ-iD,Ééæ!ÎÉ ?!Þ ÄeMv ²ÿ _PàÒknäÔ/bÇàßO[ê~¥x8§(TdÊkT°OÙiéza©$Æ ¨3I·Ë°DÔ@o§ZöóµAS)¦£tÜg\9z߬zÉÀmB 9ÚݶÜ;³ ûéÂbÐ X7i} [Cn À\lE´êàúZ© ²Tz¬ÄÎMÝiü-6 :[°Ò¹µ ÝMÇ;þ6©¥à' bwÍ[0"»N sÉPL2cÎÝ/H0r §ìÃUÍ!Å Ã.þCNõ ܽî\ø ¨²«2^"ßÚnQy¾ÿ h·Ìºm?5¢<êì&ëbþ* ¸c©:ö÷8Xê '\ö§BªH°ÎfúíÞxY ¾:PTȾësοc ÐÅ/öÙ!3Ïfëy.\bôI"Á²IhZÐPZÙ>Ô¦¦¢ÉD^ÌUò7T,µÔítcöÑ!M`h.ÌëW %¹-ÙØñ§ÚM/¡¦"º? +Ú 4ÒQÁuªZÃÙ e°NóScÄNnøö¦ª#ªü_¶ÂL Ìäuµ]þÓ¥ÁÀ?{Õà%a,G\Ò )SPÆ Â& ñFAÙPÿ æ®FíÏÈþ¢¦`p;´ð] Õ «Ö;ºV .rE¾c½?nði(FåHFbD´Oáòx¢~nù«X/7Ìéý£ ,F(ð[M"ân#¶"iL (9\E-ÖY ¥8NLoXNµ]ba îå(L.¼jÈFFF¸h´¶$gÛóL-±/ Jê@vΤ#P84м"ÎN¦ÒG=ìäìÊ`ó¿Ý4HH® ëxÚ*d]êhõÞª¡"ÄB©ª8<¥»â˧*ÄAcn\ £G}©¨Ê è;U¬´Ãûk5[5sÞÎ,iÏ¥- A²ÒC× ÑëF<Ë{ßìb£Ð W D4¬e¿·Ía ¹gkͪ-¨Ã{Å( c5Z@^&kàÉï7ÓNýêjº_ú5Âë-C{ÅP0"¦¦z éRwÒ¡BûÓ÷Ø\d°¦æ,ò[Í,i ËØù¥M4¼ønÒZN^V|·Þ/¥¹DÎ0ÏVhdØ¥ÀsB:×`ø|1O¦=HûRðq iÙÎö Û¥%TÖ®Zm ý *¶ m&°ÒÀD°ßÅ 5A n£öÒ±4n¤×Íê* rhCu ÒÌR¹aëÂ+ÿÚ Ûÿ ¼, ¬0à 0Òÿ ï¾ñ *¸ËJP 0ÃCo¾±³.åq (0Ãﾯ4}qÿ 2fs à ÿ ¾kcÌG:Á0 `ÃCh7À/Áóðý?« ê 0à <Èlðñ©+!0à 0¯^(XT0à ¬²¤gÜÈ`°Ã<2Ë( ®J Ã÷ß}óàÎõíú@| PÃ÷ß}÷ß}å0ñÑWÞ,Ãß}÷ß}ø ='qßÿÄ ( !1 AQaqð0¡ÁѱáñÿÚ ?ËЫp%{5ëÎgÔàPv :,ó\`¾ªr i=!hµ¼ !×ø¸ æÖ xí/·mB («2:cçisL¿3ÈõýE+Þ*Ò7ómÌãQDK:ð af$fT/5.Ê$oA¨7ÀªËn ÊfÛxQûR¨ 9ãÍåÚVñôÛúñª§Q¦SI+¡´ eƪä=öþý¥4;»:hå¸Ã©-C0¾1©qeÁѳ¤oÛ~ò>Ii[éÊmÚøå2·'ízJªÕÅF´4´z¸ÁÉIÊ/4ÏT?m~Ý"Al?Lev².¾» !ò£L T²[ç?+í <.\¾Ð«ã]ü³8|ª^º0&^ÿ .5Vmô.\½îÇ·£*@y=b£å.\| Ù °QõfRwÏ(a&GôÎUÉÞ L¨FpBñxöô,Âþ¡ ÿÄ ( !1AQaqð 0¡±ÁÑáñÿÚ ?HìÛÑØ'Ï9Ó bI9>×ä+ GåûzUÕ®èÉïÛ44½Æ|Û÷HÜ®«Æ±Þm1 Îc½õ¨õY DÉÄúÞôs¥RHzÜ¿ÚRÚL~£4ÈeßmèÙ3)Y´m1®¿ÖËÑ''³ôð£bãGoMG¹õ~4Û¿?u¬N'ã~ÉBGònR1ðü Z y¢EµÞÃõ¥FM¬ <ñÚ:Òå'¤üÇ2oÒÄ =( áɪ'pq¡ ¦-}u}Öûäz W©kÙbúðu#ÕöEEG¶*9Ô×þPü/6ͬ»EÂM&l§uÃRf¼(Îqåûi9 ÞY¨¨ùP7g~1D=ê~Éhl"¿#Ìp©2à×[*CÙLÿ jjW/§ÖëW;`¦¿#I´OÝë(¹CZ êúÕäh ±mï ©jGKÌÛj Eéù À²å+ >lÑÈA¼Ü¿à <ÔØ«®ø{ÐùIiI|3vì±bfVq>Ȩ÷Å%'íqrò±]L6Îu£ cÑnÕ-IWO[$ßrÖÿ (æLxãâd Â<ãÒvÊÀ·>of %¨êFÈ® Q÷M?2b¼0í:ÒE7Æðè»ürh)C7àówÚôx1:çÑùçmÈùé³D åH)Zx <µ Ù³ÀçªÀ~èå¾4¾²ÛüG§ÿÄ ' !1AQa 0@q¡ðñ±ÁÿÚ ?ú##öR?}>ÎáH"§"(rÙôÎAPBº©%Õ:! .ÆXè O²üûy4°^ãVÑq6æÃ˼¡áQKËSL+Í7(#á4qIS9EDO4âàáÐ b J Ü"¤ÊVÜÉ) Ø$®«ä×cS¡4N>· |}g;½qþ?¥?§ *ºåÊ6NR»pô/ ]ûÍÈÁCmA/~ fÇ7e$ ÈÏ/þãÅZUøpqªE[tpÐo4 =M;à þ^tgL$lX2ŧ!¾'Ó |>óõ;MÀ Èéý8F õÈ ¢VÒ#²âR] ® ZM(D0IÂé®ÍWJ ºa9ÆÝ[ ß³÷ )ê×f×ÖÜAM¢QÉJL6þJ W[¥÷ã ª° ;¨x¿8Ô¼IÂ®Í ·Þ §Ï'ðÁr¥ a:B<aÙ¼J®ÄÆðo¥Ñ RìxÞ X.ªÀyÕthØA,b·ç½¡o%vÐçÞràl¨AE-Þ¡ ªXá.V2% ®5#B5wJPE&¯\]ÿ ³ vKÛa)èÁl±®ÑPÎhÔ)ĤvBÓPOaA 6->",<$¯muURÝ×/ cípú¤LªÙm#D4 SÂ\]åÀp vÁr Q<,²qî×P4t` Ö8{ÈÜJ 7=*q.y] Õ¥Á,*<Dlê®C ²ý#Òfáø x%X¹ UB¸ v¡§ 4 §[ mME}Ã@1`X¯Ó«ª¤¢aÔkBOIçékÀ;Ï/y¾#®MdLQ6©tè'¥*TM@T ÐóñàQPÿ "m%zað:äì)J"`ÌD¤[KÀÍó/Ùä ¥WÚ×[%¬ À ÄRPR] ÐÎH.ü«UÁ bB»?Ø9&(OôÊòÀ߬¢i0Oé?y#ÁD! NÊÆ 1WGaÖ´¤wõº>¿V x2PÁ`q(b2> Ù½ kn]¨]¥ð"Ñ6ó (lHë 0 ÊÂoCË9Ü#VemÕ:0È m©IÏ5ÎÏ8é ¼h¾EðvZ r:¢BuNëA*«ÏUÐh4 l ÐFÖ9K0ð`×¼%zò<â@lPi7ÍtUO¨Gí'Ð.(Ê0ïã9²×8 TNÔ®41¥ 2a¶ù ¯°Óes¢ãG)ú_8ïÐ, W¸¾}mªtUVrÕk vMR*©ýÎ#BÔµ-[ ræró¡ u¸ò!R Z8NQ1×ÓÃêwÉô'ßÏO¢cN1¬,&W>þòb¶Pt&ÂDR, UPÄO#LG¬Ô:T¯u5åBôAÍ@¼ç.ûÏ'õg¿ÈäÕ@¼é Ê|ðÊÉ>ØÖùéòïôaóÿ a£DÝ×cËG] R'j)qÇÄ ½ I5C9ÚÅUÂ5ÄÐ4Ö%&H÷»ý¸ âOh*I¥t85£ ü wÊ@þr{Ù8À=è Â}«&é O±ôïâdr|ýä¦"|ñÈᨦLð`¨ÊvòhÍ#Ç ahL#§ TIÁBÄMËw¡ (Q#¤÷&ªüngcÒu ©¢åÂTxÉ¡²! V(BDËÅ;B t à?ÇiÞªÔ<ñüq]8êØô¢" É®°¹y] ©Çº©ÎbÐEjJjk:ÿ (t¨ ¸éjâ© Ñbi·Û uT=¡[? >ôxÈññÁÃ)·â 1C5Ø?¼51Ø_`»#¶%p4Þê X0JlÀà)Å ÕònÌÿ §QAS¦#¥ ºßÀÇÁQ¡}¢láåÒ%¡¤ hyZDØ¥§"*bô¤vPv>cõ÷(Òx}8FNE!A+¹¤)Ò`^È :%=+>]?k¼§ëåk ¼@pêÀ <ÍÆúqv0àÆ{OxgÃUI«Fj^MFËçxô=fè$SnÍä¬ ¦L-¨ZT §mþÐÎaö©>9~9Ç9¸Êx¢A9PCXrÜѤt×þwÆNÇBÎ`¨ 4 nRAm °¤ w®i<9NBV Óã Ð0ËAîÔy´äf¨XÚoMt Ñ2coXïj!лúÄÚÐGJoO^sKo ¢y)o`ÜA+?Çû¼H#`M¶¼3 töu_ÅĤÁÓXZ°¨Î öÛX9 UBóÜTåRDbuÎq·©¯¤©A±ðÐËcGcS¼4º+ûf$÷ ®¿£x1$£Dp ñ0^ð)cQDP 5f¬ÀÁD ;VåÒUú¬$ ,:M_È`;ÑM ëYKF IúDé(5ø©LDÄ sÁ³?ÕË!ÓÙ#Vuµ½,ÙhåÅ¿ °K¹)ØE#ë'Ïõðõ2Ï ±U"©JÚÀÙu¢! ¼t/EÝi3iªnn³ZZ¯ãCÆmÀçû9?¬@÷ÒV¤ È8& B?ÈìÏÓ ³t§¯jÀ ªñI%ÙF jËw/yÂ1# 80_ßÀ Ý4[¬T<"FÄjEcªK:ò ÄûXx2<êÉ÷¶/9>°¬0n/y¥×Y¶cÁ.kXÄcÃëieh4¥£Ï(QD§Oã4¡AÇ-¦# 8ú p ¤Å b× ]Îl±RoæL?!ÃØëIù3jqPíZ ExÇf"}ô=cââ''Ê>Câ XBZçLAç r[¯®ÓA7äÙ0Ïxà&Ü&ãA/J§°¦}0 ¥ bi=9¹~³õŤγª[bA!+|* _áCÁð}KadjÆ:ªBóE ¹Ð°¾ ëÛåÁdNZP $IYU<à âúÖyøåügÕÊ"Êù1AÜiRJ¶ õÞrùy aqk~ j x ba¼øá]ÑÙ êJDv&ÎZ:ÓlLSúÅÛú1ÀôX@Yí×)ÎQ¤«È4ðc¼yùyüeò¯¦Ø ÅÞ¢ª J¥b«ÍJ$ÙÕ4£kÁOë Qra*h*(râÙ4H ãA/I]ñ¶þ ~Uq'Ðø8£ðgÐë)ÇÃ5A¨Ñ =T8m6ÆÃÌ]8WMC òæS§t¢£Ñ*c²¤ð ªð ¥y°:ÁÚ}a$p Öáö|c !òZÒ S@ÊÁwà héCNßlÞ¾ "@w»»3içR`£ëÈxÇÃ?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 9692 |
| Response Body - size: 9,692 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ôímm°Æa:YÆã[jP<½ TÄd MS$ 9=Ï;èîè°[Åvî}[çþ¡XgêñºUûy;¡ ±V jÀÏz!èúnk£KÇ?râv96ÕÓy^Uãϵ§³ÒN·3uÈíåÁ±å)ÈÃ-ìß0ôöÚ>¾)Ò+hÃÖÀ Á |££ ¿-ô¯È·ê¶~Ìåu´v°Fî¥å^¾ÞÔ:Ójr·ÕDùn_Íú>}G÷Uºìþ«³©ïÒaÍClz"ES F`>X´÷|"Ñú´Ç=ßIâ³k{}b¶y,8ó× {ñz¼»ZöK.«+>½^{½£º¶ÀDT£(LUhËenóV&¥â'sG±ñí|þ?8ôÔ=-.¿·8Rê®q1å= gè q2ñ:þѪ±5 ËÇwÉ &¶2DÄÆ(º'kÖxêl}ÞË ÏgÎú½<éñó÷7Ä=§%/¯ÅÅ¿ö/ûvssöõZ¸zH |¼w| M¦<£Ó³ôÏ}:w -6xígÌçÁ©µ]óôΦ£ïñô(¬ëzÞ·r+jáê |¼w| Qj¦ÍXËÓ>mÑÒ÷úf çæ.4¶nÉ>wo õLeYiDÛ §+[±]»cËÏ\Ôy{ Ë×w|XU"@ dF½vð'ÔzýÓ¡IäTØÎj_¬ç 1åÇ*jí5ö:õ¶9Ô >àó!Þr $ÅТⶪ¾+V&½^^<3úN_5ë9®6|Y::B+d¥k+n föÜ åÚ¶¬d 2 ç" ¤ÄJÕêü¬xúýÚÑF+ KÆ>§¶·fc¼áî¡ÈAÞr0 T+cÒ>MC?>öáÈÜãÆz¹]3&×6|½nÙy ©±ÿÄ ' !@ 01P"#3ÿÚ þBl)ÿ VX&{¿Á%ãâå× r0« 8ѹg6FØ´=þO?¼èï(ðr Ç!§ÌN?ëS9nB i3ýébgÖ·`áãc[˶ùÙWFÒ²°Ö°/×mÄ éïQÃÕÊ¢a ñÞÚYS«¯)Èsâü a²U^<iîm ©Í>ìé2¦ «#kc ¥|Ì© ÿ y¯x¦ 1¹§Õì%ÖÔ×Ô6ú¼g-V'U G¦Ét2Q2Í:Sêý Ï9w÷ÔNq#ÙYTá1êÄaî°dlº8˯h ¦Ns űîÄq=l JuR©{g*:U¬V´» à"7þB";Ê×®~¼b§5N®«¨åÇE QÄá9Y<3×?^3ã+Ze|UÐÄ¢]ÅMB;JB ñ&+¯vVV<f##z]W}Æ@®G$rk¬È1P9ÉF2&_çtQªKmO²ëIöe¨0½ ÅÇ §ïkO±Ç ˶Î÷p$HCÚ9¡BÔ¥õ ´Þý±I°êõ^2Ø; ÑÙÚÔHôÄ3 ¿<[g 48ÃL4Ö¥ç<ûAÓí É.2eÓ"q'¦>IyÎïBë¡6ßò£!/g¨?ãXK»¦.>dëø: jáÐ=3ã4«g£iÎ+y1êqÚad¯ËÇã$0âäVʯî¨F¡h ð#~7TÚUuöÕì 'Ôö2©ëCaÜü©ÈðÔ=³±£ÜáÇñö-Êbë{£QÔ:ÚÅý9Ï')$Lÿ N±òc/8NsIü\z'ðR» ø2^¿FH#)È]cëõçËgÊåÜêßÿÄ ' !01 "2A#QBÿÚ ?k¹ (gÉCüzGs BAÈÿ pð³¾PÊdlÕ¾V4ûpM«ëjûxþÓÊlí®h%¡Ç¦!©}pÉZíÊtÚ·dÜ×LuúPêLË×Ê2Ç;tþ©qÝXæ¡oÙ\RÍpÂVFv«MÈtÏåÔ£uèqM?j7¸ ýû_èpzâ|o¨ôZµ~L°ð£ÎÊÌP$oY ¢6ò Él_v<±<5Ü· ßzl;üÇi Ë í¨&e´»í1Û6Ðîô(æ hÈ)eL5Uù ¢ô8qwPÉ«k^ +2]¨èÙ^ßF%Õ%¶{ ¬<ù*YÆlòë¹u0¨¯Q}æXúÉ8jk®$[AôRÍ ÖØϤ0 0ÁC ï°Òp£J6ÁÀ(ïòk0hXs¾GºÿÄ - !10Aa"#2@Qq¡±ðñÿÚ ?e(pÞ [>Ë ¦¯êû +HFcr(åõ% ±´]ivØ~&³Lkl ÀýýøÐ03ë8Qâ¢fqL L{*u«y] Kqø]iNÞ±Þ[ qÊÒÞõ4÷iªGi§Õ×püÄGÈ1Û;xpå&ål¼r I^½8ÁóJ)î&¢õXéÊpÂf°;NfsÞÌ]æ¼bÜg>}Úd¼|b]ÂÙOÂv>Å¥/Þ2ç6¾e:[/Ý&<ûôU]¹ï*êWð¾þó[ÂÞuywM °´Ø¡Ð @ì72î ÕGlG^V+çqAóc!z ó:JàúM~µ%Saaçktýd÷jÎ!¸ ÛiºkÔnæ¬úĴ驦þ%C½¼î%¤ÇÌYM-kòA² <ÍoIPFÒÜ<½¼ç@ãjÃÕycü@Üà4ågÔ ¿×ï×ì/¡n\4Ò;)4[Ü ^©tëï.´ÚÜÇìm@Ãõ+nd e5ÏRØûËXtà¿öp¥¯Ó%5©_ÿÄ 7 !1A "2@QaBPq¡#R03brÁÑð±áÿÚ ?ò°¹@þ%´PQúäHuÓ/1K¹:e¡IТ¥A¤zAZÙ(÷&áPðöò Î(xF¾[^ÆZâRJÀ(Ú°ÁE=ý`KJ08Á74|<íS< ji ]HQé Öð¶_= !Sj,á4à=t®K+ýßÇIûÃ%¶\¹)IÉI ÌKSu{»E& 3dðÊUG«BÀg}½¸Ü4çë¡u$ ¾ 4Âì-o8Æáb¢Ú,ºé½G÷1@Ë·.[zYÅ LÏ£Lµ s®MÛaXXF+>NAV³ÚñòÐ¥zF$LS1` ÓfIÎU«½ÿ ó,£pØÁ×åw1Z5ߤ @¬b ³ËDáá·á¶8h3r`÷¾Ä"YÌáW1+ôSóIùÝÂøBj÷±¼]Èg¤GÄk+·Aí8c0º¾o«ó5£?Ö ©ÿ ·Ù3$U{_.Üêf¦ívxJÒx²ïÒ bÀ[ÚÝZ)H`,Ê&¤üáÄ}ÿ ç=\µR®°Ó/¶ h©hÆ@dʦ.PDÁ¸àñ¾Amäô9zB¬¡`ï$^±-U?wÇ( H§ðì.®ÏÚàÂ/ P ºÃ %Ûêç¬îRp ,íï4eÛMV$ÁÔÒ¦U%ËB åhrÄRÊõkh©xEqø¡:ºÕf=K8¦) ßËYo¤áE=úÊ>Vó i¾lç KB źèJÓKÀ[ÜdѾïùÄë%#©û ³ UcÛ- ¾' 9g¹0Jæ2çv ±ÐTCþX/kµô6pªC¨u´o¾zt TÆ÷ÄnþV 44¸ÇEpXà}^Þº³Ä#äIñ0ºÚ \G /-5tÉ¡(\}æp¥)ag·¡ ØQá6TWR0}Õ8Ifký;TÌp|%ðÓ2ei6-CÕ( Ä»õÒV²ÉÀ©zÆñ¶;iJ娽Êý¡+ÂyÄ8¤¼¬i7Ä! EH^0ÉÀa¶ Þ¬ &â)w ÌÜé¿»W´Tà¤àÝ"Cârïö Ïáÿ ánüy¥¯¸h|ãr<4m)),ªmLåT±wòKĬò¥9¶Ë$zGŪ\ÊZ¾¾E©\g<MýS{un@ IÂÖ V ñþIªÀøWüà bðuööýàXR* `3©R4'P PÖSr=`TèúÄE|$_ "XJ %gLCätÿ ÿÄ * !1AQaq ¡ð0@±ÁÑñáPÿÚ ?!ÿ ȲM°Ú?§¤Ç¶/θ9h¶>Fx?AûEF[³À´!uö¦º]y¢ Ò¬"»w' ç:ûhÞ,Y:«·2°7O¹}h&ÿ ÃCkzl´æ Iÿ ?åMº zÉ [XóPRË"àÙú8$sr?Ö&Yj ñ¼y¿-Og°÷úqö/näÓ Ùà M±¿XqcuÃÇo4qE)ο¾áK\Û Ýß ÄÖØ>Z6ÖÞÜ pT :üBC\~êÚõyRq~«êM@ÞòB=êä,ÜYKãõPL8X÷mV Av¦úi§½¾ÖÁ2Î DI{ÌAóY"*b]'{eÿ "Yr ÛþkVªtÍ*ÁN-ùßJ´[Íã=·èÖÏØ~iß ÕÈò>;ÐáÂmÆ>ê3MÌ Nç:. ÈÔåÞÄ»TÈ%Ç ÂEC3¬_ü]Ù24Ò©CAxÕüµ5³u¶úR¥¡¨,!# ©zµb&!³þ&HXö©©B- ÆþjrªÊ¯éY±Q"`þ=õÅwôÇÑ}IÀU9p¬É¥E¥0/ÄüjB&¢a¸Àérü¹.áÍ°üÖX|¸T;°²Bû Y|ÓIAVðM IfRI:SÖ¶ÿ å¾Öí9æïZH&É4n»3hY³Ö-ü«Ul¬½_Sõ¡¨©ZàôY eèvµYÿ fÑ=cZ)qÖ-Xæ à üÊã&1:ÁóÓ1Mùµ-iD,Ééæ!ÎÉ ?!Þ ÄeMv ²ÿ _PàÒknäÔ/bÇàßO[ê~¥x8§(TdÊkT°OÙiéza©$Æ ¨3I·Ë°DÔ@o§ZöóµAS)¦£tÜg\9z߬zÉÀmB 9ÚݶÜ;³ ûéÂbÐ X7i} [Cn À\lE´êàúZ© ²Tz¬ÄÎMÝiü-6 :[°Ò¹µ ÝMÇ;þ6©¥à' bwÍ[0"»N sÉPL2cÎÝ/H0r §ìÃUÍ!Å Ã.þCNõ ܽî\ø ¨²«2^"ßÚnQy¾ÿ h·Ìºm?5¢<êì&ëbþ* ¸c©:ö÷8Xê '\ö§BªH°ÎfúíÞxY ¾:PTȾësοc ÐÅ/öÙ!3Ïfëy.\bôI"Á²IhZÐPZÙ>Ô¦¦¢ÉD^ÌUò7T,µÔítcöÑ!M`h.ÌëW %¹-ÙØñ§ÚM/¡¦"º? +Ú 4ÒQÁuªZÃÙ e°NóScÄNnøö¦ª#ªü_¶ÂL Ìäuµ]þÓ¥ÁÀ?{Õà%a,G\Ò )SPÆ Â& ñFAÙPÿ æ®FíÏÈþ¢¦`p;´ð] Õ «Ö;ºV .rE¾c½?nði(FåHFbD´Oáòx¢~nù«X/7Ìéý£ ,F(ð[M"ân#¶"iL (9\E-ÖY ¥8NLoXNµ]ba îå(L.¼jÈFFF¸h´¶$gÛóL-±/ Jê@vΤ#P84м"ÎN¦ÒG=ìäìÊ`ó¿Ý4HH® ëxÚ*d]êhõÞª¡"ÄB©ª8<¥»â˧*ÄAcn\ £G}©¨Ê è;U¬´Ãûk5[5sÞÎ,iÏ¥- A²ÒC× ÑëF<Ë{ßìb£Ð W D4¬e¿·Ía ¹gkͪ-¨Ã{Å( c5Z@^&kàÉï7ÓNýêjº_ú5Âë-C{ÅP0"¦¦z éRwÒ¡BûÓ÷Ø\d°¦æ,ò[Í,i ËØù¥M4¼ønÒZN^V|·Þ/¥¹DÎ0ÏVhdØ¥ÀsB:×`ø|1O¦=HûRðq iÙÎö Û¥%TÖ®Zm ý *¶ m&°ÒÀD°ßÅ 5A n£öÒ±4n¤×Íê* rhCu ÒÌR¹aëÂ+ÿÚ Ûÿ ¼, ¬0à 0Òÿ ï¾ñ *¸ËJP 0ÃCo¾±³.åq (0Ãﾯ4}qÿ 2fs à ÿ ¾kcÌG:Á0 `ÃCh7À/Áóðý?« ê 0à <Èlðñ©+!0à 0¯^(XT0à ¬²¤gÜÈ`°Ã<2Ë( ®J Ã÷ß}óàÎõíú@| PÃ÷ß}÷ß}å0ñÑWÞ,Ãß}÷ß}ø ='qßÿÄ ( !1 AQaqð0¡ÁѱáñÿÚ ?ËЫp%{5ëÎgÔàPv :,ó\`¾ªr i=!hµ¼ !×ø¸ æÖ xí/·mB («2:cçisL¿3ÈõýE+Þ*Ò7ómÌãQDK:ð af$fT/5.Ê$oA¨7ÀªËn ÊfÛxQûR¨ 9ãÍåÚVñôÛúñª§Q¦SI+¡´ eƪä=öþý¥4;»:hå¸Ã©-C0¾1©qeÁѳ¤oÛ~ò>Ii[éÊmÚøå2·'ízJªÕÅF´4´z¸ÁÉIÊ/4ÏT?m~Ý"Al?Lev².¾» !ò£L T²[ç?+í <.\¾Ð«ã]ü³8|ª^º0&^ÿ .5Vmô.\½îÇ·£*@y=b£å.\| Ù °QõfRwÏ(a&GôÎUÉÞ L¨FpBñxöô,Âþ¡ ÿÄ ( !1AQaqð 0¡±ÁÑáñÿÚ ?HìÛÑØ'Ï9Ó bI9>×ä+ GåûzUÕ®èÉïÛ44½Æ|Û÷HÜ®«Æ±Þm1 Îc½õ¨õY DÉÄúÞôs¥RHzÜ¿ÚRÚL~£4ÈeßmèÙ3)Y´m1®¿ÖËÑ''³ôð£bãGoMG¹õ~4Û¿?u¬N'ã~ÉBGònR1ðü Z y¢EµÞÃõ¥FM¬ <ñÚ:Òå'¤üÇ2oÒÄ =( áɪ'pq¡ ¦-}u}Öûäz W©kÙbúðu#ÕöEEG¶*9Ô×þPü/6ͬ»EÂM&l§uÃRf¼(Îqåûi9 ÞY¨¨ùP7g~1D=ê~Éhl"¿#Ìp©2à×[*CÙLÿ jjW/§ÖëW;`¦¿#I´OÝë(¹CZ êúÕäh ±mï ©jGKÌÛj Eéù À²å+ >lÑÈA¼Ü¿à <ÔØ«®ø{ÐùIiI|3vì±bfVq>Ȩ÷Å%'íqrò±]L6Îu£ cÑnÕ-IWO[$ßrÖÿ (æLxãâd Â<ãÒvÊÀ·>of %¨êFÈ® Q÷M?2b¼0í:ÒE7Æðè»ürh)C7àówÚôx1:çÑùçmÈùé³D åH)Zx <µ Ù³ÀçªÀ~èå¾4¾²ÛüG§ÿÄ ' !1AQa 0@q¡ðñ±ÁÿÚ ?ú##öR?}>ÎáH"§"(rÙôÎAPBº©%Õ:! .ÆXè O²üûy4°^ãVÑq6æÃ˼¡áQKËSL+Í7(#á4qIS9EDO4âàáÐ b J Ü"¤ÊVÜÉ) Ø$®«ä×cS¡4N>· |}g;½qþ?¥?§ *ºåÊ6NR»pô/ ]ûÍÈÁCmA/~ fÇ7e$ ÈÏ/þãÅZUøpqªE[tpÐo4 =M;à þ^tgL$lX2ŧ!¾'Ó |>óõ;MÀ Èéý8F õÈ ¢VÒ#²âR] ® ZM(D0IÂé®ÍWJ ºa9ÆÝ[ ß³÷ )ê×f×ÖÜAM¢QÉJL6þJ W[¥÷ã ª° ;¨x¿8Ô¼IÂ®Í ·Þ §Ï'ðÁr¥ a:B<aÙ¼J®ÄÆðo¥Ñ RìxÞ X.ªÀyÕthØA,b·ç½¡o%vÐçÞràl¨AE-Þ¡ ªXá.V2% ®5#B5wJPE&¯\]ÿ ³ vKÛa)èÁl±®ÑPÎhÔ)ĤvBÓPOaA 6->",<$¯muURÝ×/ cípú¤LªÙm#D4 SÂ\]åÀp vÁr Q<,²qî×P4t` Ö8{ÈÜJ 7=*q.y] Õ¥Á,*<Dlê®C ²ý#Òfáø x%X¹ UB¸ v¡§ 4 §[ mME}Ã@1`X¯Ó«ª¤¢aÔkBOIçékÀ;Ï/y¾#®MdLQ6©tè'¥*TM@T ÐóñàQPÿ "m%zað:äì)J"`ÌD¤[KÀÍó/Ùä ¥WÚ×[%¬ À ÄRPR] ÐÎH.ü«UÁ bB»?Ø9&(OôÊòÀ߬¢i0Oé?y#ÁD! NÊÆ 1WGaÖ´¤wõº>¿V x2PÁ`q(b2> Ù½ kn]¨]¥ð"Ñ6ó (lHë 0 ÊÂoCË9Ü#VemÕ:0È m©IÏ5ÎÏ8é ¼h¾EðvZ r:¢BuNëA*«ÏUÐh4 l ÐFÖ9K0ð`×¼%zò<â@lPi7ÍtUO¨Gí'Ð.(Ê0ïã9²×8 TNÔ®41¥ 2a¶ù ¯°Óes¢ãG)ú_8ïÐ, W¸¾}mªtUVrÕk vMR*©ýÎ#BÔµ-[ ræró¡ u¸ò!R Z8NQ1×ÓÃêwÉô'ßÏO¢cN1¬,&W>þòb¶Pt&ÂDR, UPÄO#LG¬Ô:T¯u5åBôAÍ@¼ç.ûÏ'õg¿ÈäÕ@¼é Ê|ðÊÉ>ØÖùéòïôaóÿ a£DÝ×cËG] R'j)qÇÄ ½ I5C9ÚÅUÂ5ÄÐ4Ö%&H÷»ý¸ âOh*I¥t85£ ü wÊ@þr{Ù8À=è Â}«&é O±ôïâdr|ýä¦"|ñÈᨦLð`¨ÊvòhÍ#Ç ahL#§ TIÁBÄMËw¡ (Q#¤÷&ªüngcÒu ©¢åÂTxÉ¡²! V(BDËÅ;B t à?ÇiÞªÔ<ñüq]8êØô¢" É®°¹y] ©Çº©ÎbÐEjJjk:ÿ (t¨ ¸éjâ© Ñbi·Û uT=¡[? >ôxÈññÁÃ)·â 1C5Ø?¼51Ø_`»#¶%p4Þê X0JlÀà)Å ÕònÌÿ §QAS¦#¥ ºßÀÇÁQ¡}¢láåÒ%¡¤ hyZDØ¥§"*bô¤vPv>cõ÷(Òx}8FNE!A+¹¤)Ò`^È :%=+>]?k¼§ëåk ¼@pêÀ <ÍÆúqv0àÆ{OxgÃUI«Fj^MFËçxô=fè$SnÍä¬ ¦L-¨ZT §mþÐÎaö©>9~9Ç9¸Êx¢A9PCXrÜѤt×þwÆNÇBÎ`¨ 4 nRAm °¤ w®i<9NBV Óã Ð0ËAîÔy´äf¨XÚoMt Ñ2coXïj!лúÄÚÐGJoO^sKo ¢y)o`ÜA+?Çû¼H#`M¶¼3 töu_ÅĤÁÓXZ°¨Î öÛX9 UBóÜTåRDbuÎq·©¯¤©A±ðÐËcGcS¼4º+ûf$÷ ®¿£x1$£Dp ñ0^ð)cQDP 5f¬ÀÁD ;VåÒUú¬$ ,:M_È`;ÑM ëYKF IúDé(5ø©LDÄ sÁ³?ÕË!ÓÙ#Vuµ½,ÙhåÅ¿ °K¹)ØE#ë'Ïõðõ2Ï ±U"©JÚÀÙu¢! ¼t/EÝi3iªnn³ZZ¯ãCÆmÀçû9?¬@÷ÒV¤ È8& B?ÈìÏÓ ³t§¯jÀ ªñI%ÙF jËw/yÂ1# 80_ßÀ Ý4[¬T<"FÄjEcªK:ò ÄûXx2<êÉ÷¶/9>°¬0n/y¥×Y¶cÁ.kXÄcÃëieh4¥£Ï(QD§Oã4¡AÇ-¦# 8ú p ¤Å b× ]Îl±RoæL?!ÃØëIù3jqPíZ ExÇf"}ô=cââ''Ê>Câ XBZçLAç r[¯®ÓA7äÙ0Ïxà&Ü&ãA/J§°¦}0 ¥ bi=9¹~³õŤγª[bA!+|* _áCÁð}KadjÆ:ªBóE ¹Ð°¾ ëÛåÁdNZP $IYU<à âúÖyøåügÕÊ"Êù1AÜiRJ¶ õÞrùy aqk~ j x ba¼øá]ÑÙ êJDv&ÎZ:ÓlLSúÅÛú1ÀôX@Yí×)ÎQ¤«È4ðc¼yùyüeò¯¦Ø ÅÞ¢ª J¥b«ÍJ$ÙÕ4£kÁOë Qra*h*(râÙ4H ãA/I]ñ¶þ ~Uq'Ðø8£ðgÐë)ÇÃ5A¨Ñ =T8m6ÆÃÌ]8WMC òæS§t¢£Ñ*c²¤ð ªð ¥y°:ÁÚ}a$p Öáö|c !òZÒ S@ÊÁwà héCNßlÞ¾ "@w»»3içR`£ëÈxÇÃ?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 13969 |
| Response Body - size: 13,969 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ {ÅÞá¥{æ\Óbð78öJÙתH*HùÖrϵËéòVÙY1rÉ;¸ô5Ly0×°f× jâ6)Ô#³¤è4hÕvbRÒÞ·=òÚIv.s®No+ƽ)`©(u¡º»IR;âôyÓ¿^©ðv) ©Óê-¬j n(ñsäJS¶u^¡5&fÌfÈI4¶=ùåÜgôS¤±Õ#,ös%~¶ ©ÎäK£¥µeyÓ©kî4î¼ìç ³µ}Yèy¹Þ«ñæÙÈU@è¶ÍM¸XÊf !ÞCÓOhxnWbK¶Ë]ÐX] ë2%ct4µ¼ÐÄ£Ä$i/«=`ö ©¼õ{®ÂºzB×µlÜa¬½ [íY·°ékã|êÒZ&;åKu ;³¹A;Q1ÎméÒLª·IZ5 F[å4 tN ¦¼ÚÄ8@òx]¾RÍì'§~]ÄaتÃÎú:°<#,,ÐǶyÙØ+°EÈÀiÛcÅFÙSåÕ!LãvfëSmÊæ tkÍég!JýÀó@:5aËYì¼n Ìܧ¢dA£Þæ|íqõÎQE/y ß;ë7¨Wkf2àèº&LS¯:] ëÏvsÛåÑKOU®Ô¶µç§ihÀH ´X ¡'=ù¤Õ¦ª¤G©xYGÔíôû¼ ¾2CÅ´æ£Á¶õÈè[íÎ×%´æsRÆÚî=³´ i`8Ô`ãK³íg6¡n{ò è¨ì*,Ìæ¹Õ!ðuz¿ióJ|î»üͼ۪È5èðcÞØ9ö§cRnÓÙÆÚ VfÝ&Ñg'7;.âzFùK·= <½z3ãfçl¹d§}sªZ̧ ¯ËJuæ½ tÖ°úá :'Ð4w2G¢Ùi§3Z¶î4ÀÃÛdÒ uqfòó°áGêÇ=äëÒæVøÍØèuÊÆ>Ã+fÓGE·Áfmm`¼ÞîB ¡Kú ®7ò0Îóy lKw`À"ÑËL ²%g´ß íæ$d\étË5ÇY66×dÛUDÓ]ߨôGW)ät5-1u"+¨°ã«¾¤]']ôó=N&{+MlÞÞ{¼ÂCÃgVOËÌMṳ́¢~dzr<ÆËQaÑÉ1æ+ÜÌÊò?1ioG3qìÌd3Ì 3 !ÌZ¿· 4æ<ÚYYÝd÷ÿÄ ( ! "102AB#CDÿÚ zyTgÚ¹©GMäõß IÇ#Ú¡X.t¶Y ËÆ¥u_m%,ß$?ÊøﺸÈ^3Epë W,l jg«Mä~üw«Ëÿ )xè\hÙu©YMPvAbúé}ê¥|ä£â_;\iS²ªt¿ D{FËáCixÚodòÉTºÅiäOÔzØ«Búie²ß)Ø£DûU k® ) Âá3x4¢ë®/ýRý®,1Íq¤å¹+) Æ9aä]ùy1ÊSq I ÷ªÝ[Ã.×v&]ý|sM.ýS¢ãK'ÚT@_M'f]ÖÙÕÞUTÈ¡ ÷²-ÝØÞ%ìþ>,þµnñsNTÿ CKeêµòô.t¾ÞÝÇä+¯¨!Ö©vÍê©jÒª}pÙù®%,=ZV±.4r,¶]sæ 4õi ü:hË"¤9JµjÒ_¨¼ Í&ÿ ~Í-z«BãIÙæûÕK! ô_MãM'l`^ÙdÜÛ²¸èË#«z´ôe¤eé²-îöWéO ¸Òv íuú+4Ó±+º»/qU½³É½Öü{{ø·|¿3j£4ÍbÒ2ÃI^ÛïGìC {. ±Yc#^ÊÁBãM;º0R¼ùeÖ«¡at¬·ÅÊ¿¿VQò+"| 2gM2fûl[º;~oå \Jx=¹ÓNÇÌ]ÞJÏû>Uw ªT(RT¼«Ç=åî"ô~¹oÿ ß²?½;X.4ÑÍ#æöíeMö¥IJ¸Ø¼r4¬ q¿ ï}>dë®;J(Ñ!ÓºGÍïäÅ\Ø©hHHÁ\®W?#MObØÆI÷å tµÃ?gOQV·ÿ ´ÎÃ?) ¶(kQBBÝ õhâ¼ìå§ézj þoUÛ¯©É6½ñë#1B.P¾¨_UËÇÎéǧT|)%äTÓC%'9B&&&&oó¾ãìI÷Ãge©ö~HW×ñù.SôܤÇç¯Èüȹ%Ùçy åÚ»»E^óçq®pÍ7zÉò!Ûæ}ÒÍ4ÞXÆ> \îûrýJ]µaT|Q>$ÇBêüm Ô9«jr.uÿ óÒiñ¶VÙä8NRTGÆqù)¸NÈ/z¯]!äE¶Ç!¶Ì%¯Q µFo·oûS÷Â?ÓôFhB¹FaÔê*c¿ / ²L¢¿ñ²ß%«]<¹ÉOƵÿ ã§ÆÆÌoG?ñÿ 1[ÃmG] bØ´!\çadªR£ÜèEjåV ÁìQN<Id¿år×Üu%Æ %ÂÌuܤE_D/àÃY<1ÌQÁÛÃôaï©ëpí!Àêâô\`ëLn5SØã4ÄÅÊðÙf¬Á2Á¯`¿xKñ!ía8vNN.EÆJ´ßÃÖÊÔ¶«¥"7EBå}¡Q,x<&AzhöÂ^¥ÇT_AJgÆê\aª,ø¥Ó ®åa£¥Êû`Éú3¼/sôÑ_öÂÄWúÂØHF ìö ôÂTÅña.Ñò2PÙ¤/·ÿÄ ( ! 1"2A0Q#BCaqÿÚ ?1¿¡ôòMÛéòðMý.Ê)Aµ"ûS£"þÝ?ÇÓ®]uÙx±½Wtã~èôÇî¯âe qÇÓ ³%.NßD¬IGÜÇ'Uß S'¶¼ßfXS ½¬Q¶fýÇÉgzé9j?»ü hÅ*ÓðK W(Zf8îÉ+dý8ر(îD²^Ú7tÅTkçbÈx«h×F5¦Ey+B\vprc¬~<n^z$Ù麲¢Q^z£ìô$\D³ ìpú½HôÛ=$¾Ls|!åE·ø Ú#6ü1+Qªö9Wr$?IJÿ ¢90±Æ3òdz$Ýè%yWèycú9Ãô¸hâªÇ³ ZuÒ£ "ÉúíG«D²^ìt7 Äþ«¶ËÚvrÕHÛcÿ ¤[äÄîËÑ'jÎiêFH¸Ú=U/ñ§ð¯Áê¨* j"ê6BZd%zéËõ/Luî^:úìj/Á(¸é÷âÔ 2j(ö³÷<pØÌskFHÓ×dY5CìÿÄ ' !12A "Q0BaqRÿÚ ?$¼ëùi.ÆÐϧ»Æ=büiùi?{¡ÈXÆEÖÏIlïGÞ´N夥á VCßcÏ¡IYxdª!+D»gOä±!ßFèI¾}tR,oJÎÙå G°¶D}ÎË3Ë´Q¯SɽãÚ)Ù?o¹Ç$N}£Í!¼Þ(ÉE çÈitfe2¼¥V$äáϧðúõ|Ë0ó.LÒ3oT&¯SÕ¦¼É GDºôÎRÎ~Âùdb iÃö>:V$úr½1!ù_ìP&/ä÷ âؤXï£EÉð8_$¿Ì>'Ó½Ñ nF8ñÀ¡n¥ ئ¾Æ+Üfóþ ¶% #~Itë(TȬ #[Ĭ«1® «»ÖÙ[ÈdV^æKy$Mn®(Ú ì<®HËƸÈNõc ÞIiæ5¹>ÖGi(Ù~Þc?ÿÄ 1 !1 AQ"0aq@¡±2BR#ÁðÑÿÚ ?ÂEÂsP*i¦\=-¢ºæÇI Òé~éÎf[ÊÊ7¤¦»ùÒ9LkE&Ma ;" ®|èê *Õe$ɶ³-;pT u6Ý9¯IűB³¸uLúvÊ ç]t6¬(Ñ ´þ¬©®=ÉGªÜY~=øåEÞ»§§úÑxFº$i¥FêH¬ ÐÒ_j¦².x ºèè@ /U1¥ÕDhÉ0 iª7M%¾Èjºuµ¤Í=4IübCUo¾¨·2B`îº ¾ ¢,E5í\ho¢¤æôÕ#ò" ªiÇÐÕGíãböÆÑÎ"÷öÔfÈÅï Æ%Fa[/ñºß·ÖC´GûÄb>ØGb ^æèдî§çàÐ. qe¿áOÄcGÜé®4ÖA ãTà6Sn×Q#î¥Ùk°NÌ9tÓ0¤ïK¬ßÄIÊ!8ÇOܬ$]"G)³pn«kN2.Û `0kx®D{&ôðRôË%PéUò 7ÙUú¹ Éò¦ö«¡¢w·ýÿ S»UþQl§f å Äì`Ùÿ Jw+UA Ñ"@â~ØF ÌÈþ·º.Äàæ7 ö#^wSæbW BLP_FÂ}5k B.£a\Jó¨ \E«ç;©uO?OYTû ;¨5 Zdu=HêI°²Ìë.¸Þªÿ ]eÒå$Gàú,ßtÀ°ÛÝK^ G+oÍQsOÖÒG¾_¤/ÐÑYßúB>B ¢TÖrÄJ5o©ú ÿ ê#iH·jçdÕJû)ò¦òtU ¦£Ê¨]@"TUSݺélWÝKþÆ·ò¯áï×gºOª¨P/Ù¶ ßÑÓ ê¡·ÜpÒµNÎÙ B ÇáP8s&èÃÞ÷YsA_åË^Csø26ÝAé< )\z;a˽hd]ÖjÓ óÕ½w@ ¯8Q~ÅÔ´;%=éÊ%QÄÒ{pïS\óÒ 0ìæåÜú§NeüO%7æeÎv% O2tÒ6µvËÝz(ÜÛ£:(·Uú "Ò(TætÄHC§7ª !¾NoàÎqª¶Rm¦åeüý-F8xÂÂ1«(Ý ÀLÜ Ôøú 3|cLhñ<hñÄjp²æSÄ«!Ý_C«"ÔßLi7¾j¼ê°D6+ºøË^% ¦#ù*÷LcxìO 4PIåFúÍÔeo¨Nsº? (}Ô´éØÿÄ ( !1AQaq𡱠ÁÑáñ0ÿÚ ?!f K,²åß5 çðK-= 8 ο/µ.wí¸=4 xMÁÉ©gC²bàw?kéÖO^ó7Ðo¥½-e®;¥Þ´ÔËÛ @Ëä¾3`«â³TäS+êüTu9ADV§¹ïpý Ëè R0ß|ÔPÐ-íÐ=å A@?.ó Í»ÇÄ 8è=-¿èkÖ>aiNen(¢éë,´P¯/?Ô ¸ÐÍåÛÚQC]/Ì^:p!®ïç¡lSlï(8XbdÁ(Z¿ïî ÷¡¹o¸ve½Y÷!£i4._É+°qгl ÞB;3$°ëï?ø zd@Aeô¨aV+¡eø¼6E.Rákóÿ &°z2Ù| ýÙIA¸ëè¤=÷M?2ô±zZüzïT"«ïÀvÑó±\ïCC¡ÐéXº !çÌP±EóG«ZnÞY¬wÓña¥¥ð0 BX¯açÞ)q¤$W:¢0, ûÍaåô 6XhMaOù ]£¼Â&FZµ÷ûÁ6ÿ è=8¥Ü+o Ó ¦YÏ=¿2â\yxÌM¥ð%¿ì³S~ ¬5=¦}PÝÝb½=á RÈ×ÍTh¯Ç SáÚÝÂ8Êå{Á4Ôz\¸u0R ï¼¹AE® æ5wg¿],๠ÃæBÕ£cï¡ñÓplh^ Lt õJH uZ¬ÇyÛ¯Tq>ÿ ²©¤!® ×K._à ¡(khp¸0îÆh÷¯½á k.-Öxù¿xEj[ z ô¾ks÷Y¾è9KÆxÇ y³Ï˺ÿ f©¤5ÐÔ]à×EÏWN ÙE÷¨ N}&e_oÇh7ÔL1èàmÝáííPF"ÛU,S T ð.Ë·KrÇ{é î®ð __9 YDÒ¢Rá¹^ð¨¤ãDjüK±q£_{LpÉB/# bËïâõ¿ä9·½Seùàräï>É¥c RÆã:tdAU(Å{Í#´u*\æC¡¯ &$lª@þRªuqê(=JK.ðLs¥JïbÝ6MQ·°q;`Wlñ|ÂI˵G8óÎ&:ôAîÛ¿[Ag½Pè|͹Úî®,×}¡ .T¥{J±A# Û S] /GT¾f²î'gm{pCШM ËKû@ÁBfÞÊ((ÖØDû63éíº3ø*¶öûâ/©'?½¼J9«ÊÅOPîá.{°vWYê+¤ nMüÀõEs£UÇ~#jÏi¬2Ú¬7'Ïlãá ¡ÞYjÍxò¡ æ6jÃÓ D[ia`ªãØâ¢kuǸ1 !=ÜE¾!ëÜçæD<Aè*Bz «%]ï¿Ê\5TY˺ûq\ Lv¸èB£þ,à·ØûýDu `âüüÃ-`q¨RN^)6Õút¨C°rç´ì¤âçm©û*ÌÆÍ/}°îíÜ%ñAè ¨ñ4¸nwߺï*iÃCºr À¿ÑcPÆ© àǽ@¯ý*?Éû ,Õo1ó ¼Ú¦þâÇ»P ÜJµåè ¹|@ ê,Û¿µ3Öñ1´ÊYn Ç@AᾺM¿×SLÑ1»ø0g)zBÉSníÂG¿sæ5³´g`ví;òHX2=ÞÚ -å±[ xÿ ²ü û¾@|ß "Pd ¨Ø³ÛG¦ 8¦âM¡¸uÒmÐÔ7ÓNª8úYr¤ &q4ÀÙåòïº.íx}»nÃdÆ]Ýþñ$»ù^ݾaiP)dzXÆ¥ð6B8â(¿x0jh7 tt#Z1¡ÜÔ¹jWµ q² +EA Ð÷/ïþÅÒqÓݯÌ*¾ch>¶Ãé§AòÞè`¬È æx;`>¬U+»^»>íÁeêË´ã ûsYk¬Úåßë)ZÜâøâ9ù +rÙg- Õýâ]óSYà+^\ÄL ÚûÄ``îXê¢ñ³ è×X°I²sÌi2&2Di>HDÖÝ`= eÁK¨ò¡Æ` *En HO\Í9Á;äß jpR¯>5W99SïϬ¦VâÆ«? U÷0²ÕhÍoª ]ıcQ27OÎ[¸8¸¤çz 5Ç߸\}0ýÞ3 »*/Ñí1ðÁËÏùç&<%¿´±R Ó÷ Ì&[·¬îYgïÓÒ Z9q`,·díwÞ;$*ø´Ö¯çN»B&5(7\}¸*xÈÚТËx0 Rì·ýKk ÁGþ Ñ v1 Ë*î¹±?O¥1_´%üÅÂÍÝÿ QÛ%höÿ Î.3ÿ B;Jö÷L,m%Åa¶ïÖfa¦ ¦±;kzí_Ü2zåwòè¬c 8Û©hø²sÌf ÝÛWúï8NYÿ %çÁný¸®}ækKbN&3/Bhªî(´[QÕKÊ´Ðkû¤]×9\³à§~¶PÛT o ¦Óºâ+» ɹ{ÄmÑ¤Ò \Ðèôôh]]L ªH®;´,Ïû¹R¤ bó¸æ/®qeÀÀ5¼ü{Nö¢y |hc=ã²"«%2÷¸ªñvWEÔ° Ùò7[ßgHLãuj æav¡´/ Ár1M!¨CSH:@¸¥Jþ ;.Z( CQèÏH n³ÄÒhòÄ©ªpã8Ùл&ãî A¦ñ¬½¢X5µéfO Åmy{B wÐPÔ54t1 u©F,Ü\?HãÄÄg¤¡Ã ã í»ûë a¯ÆaEX.>ñQ9V m8ÀgÄÊN fÇCO¹taâ8Öð§y¸9Ö:K£ho¦N¹1>NSk¡À ^;Ë Ì׶7Ðsq&!¥ly©G=Ȧ,ÞüNMS}`FáÉÞ$NgGãÂf;ñ¹T®§Ì · #g Pé¤7Ðèt©/}Ú9ÒRA.Á«kÏrïµþ¥ ¿Û£ 6àÍLÏ ½3n4j@ VÑ2ÑýÃmL sH@Ó`ªe½1Ú§ã·Ô±<^!aö»Çõ@&kR Ýeqt uÿÚ ©¼Å· ×Ýðz ¥¢àu¿ªawdÒøCÉþ&!ôý@6ßMí[T¬D #ÄÅ¥KUÅ;Ð×âBò´fbTÙ5ÚþÂj¼·KÞMÈÖáõc©A Ó*OÙmW°úÁ²Q*C븥iÅñdªýRq¸aÆ%Ñâò Y´Mͤ¶FÚóð÷IÄ£%ÍPQæbàwùZæãCd'Щu2ñÿ B| ~?] ÷ùÿ <ÿÄ ( !1AQð aq¡±Á0ÑáñÿÚ ?ÿ Ø)Oe®zã㯳,_ÏUmù- ~#Z*+%À9õ¿ ϾÏNqo,h ]ïëÉce0ELîûÔ·^S¯ÌøQPÔ¸<_YÙ<TBLÅàþüøçPú´aæQh!ÉÓ ®&9Ñá©Öü÷ß¾`]D¢â0ú´Ðjb®ÉYzCÍÆbßÖæ)Qúãñ<¼Ó=ñë3sÞûô\Fûâ 1UÒG=bs ùI ôÖ¾ø'ÖuE/Á¤&rà qññ.Xâ©Éï[eã±Wí¦Dà I{uZ76µ¤"°+½âô¯û¿â;ø4ÌÇeïÙ¯#Pjá/¾øûEüWñõæêV×HpÊ?Á6Ô^h8vþ~~¥¯Lýw¾Ø_Ìæ3u_ÜG߶¢ ¼ê:FIW¨*¹¾ß´3¡Å±ÌñÁ)Ý_ÌO{'¼³Åm7e È©òÚW¸dêd h¬þ%ée`h¤míWîzCU(Äòì·£öK¨&Ïxj¹ÔÈzLßj]³L«m]ÿ ÏMBË¿©|á¯Wý~E9<øÆð~Á,Tȳ¶pD: WÐxFDë_°9. kÉÿÄ ( !1AQqð a¡±ÁÑáñ0ÿÚ ?´4à-Í«ß¡ p3lm| |G«YR¥{yW¿{ðvü`¸1à k)£*:pêó§ veË . f·wó ÑÁ£o -2ýqKåÅÊXó%Ô6me¬#BÙóç½ae¥jð=PÞiß}`¸àÍJ:Fé4`áÙù×￨¥M\zÍm6 b°õCÉËàZË.X9tÌ 9|CQÒ¼ÝóÔÇ(x8`W¬sÿ %FÎaª9ý09F~Ê ÿ Q²g ¡8#TÉD°ß¾rý½ oSN×\|Áó0ysrëûìÕóý ´fdjãÓ»»¶fºûi [T Å]!½æO ¤ÓÂB áÒhÆÏ=}óE^¦Ðª%{GëßÜC飪ÿ ÚvõÓêÁ4*ù+î«óýNøĸSüµí´ú°B õJÓÏxïÞv½»ÞóÇ¿ì\«ñß}!pV+X)WÞ`V Æ· *ºÍÖþ#/ò9-Ü÷¤¯!ué5m°ôo( õLÓÞ; ßTX±dÖ< ^" zX÷?®ôÐ WÎß©GÌúG3â éöE=cë¬#ª][TðJbÈ%ìJEErC/Ô°<å C0ÛÊTêK"¶¼õ» (síYà*"®~?r¦VË0V&Sx@Ëxß ªzüDvÙ¨A4ðÿ ÿÄ & !1AQaq¡ð±ÁÑáñÿÚ ?P®:PRÀ0{sÞ7IæUáz9Ü6êÐáÀve8Ö@0 cÏ}tÃ(騲ðÏ ~°ä]å|¹= àCU¡B ¿×s6hÑ[9åß÷Ë°ø± ox- °Ú|gX «B f°äÒbUÏ(ZáË ù~=Ø£é¯y¦ø´ýx ¬'Ð hàÚ=®¹È×}*¯hRq ÊÔ§Z#Eº5NÓ!UÑíÎ³ï£ 4¿ ^r8ÃÍ¡@ÿ ÒyW^×}×y1]5O¼5ClKa|^2¥¦(ìòzêOä~ò<#\fÈ:iw8êrzÎ6[º'Ý×Î>LSNÌCmfàÂB·T³N¾$m-P5ZR¿, @<cÃxi wçé,T@B®èraIÌk8&ÍÇçê;àRKñúé§4C¥e㨽'.P \hñãY!¬ï ùaßãñ¹ÿ X'qëçÄ Õºuæ|Ls!L´«[U½róÝÁ³=Ù¡}äöÁÑSæYÇûÒ*;PùùÉÙÍKõJ\ÅDèt8@½ªùÊÙr'«3Vä7ÚM&%Àk½@ ©F.0üÆs|â£ÖOO L Çò «Ë@rX =êäò°¸B¼8ã±/&+ªÏ qç§Àñò¡/.µ@<~4`ñÓñÛðµ? 1 s. wê@" ®÷%j¤ G9pä1¦[¦¢ZO<@XN×Îîi×Ö>&N¯U´XJ®·®,¯N ÖSfQ˨N¯Æ µ(åx mÒMÌ@Q ÍïÆh¬qq+Xõɨ Ü«Ú¡N<¹úêÒ=-¼¼µÀ¡ÄwxÐ ¤¯-äíªjÞlÀ¶ygççy0ÖðDÁ Ïòg#ðãøQ¸4ÖHÄ:YjݽíÊn-_Ö)°mAèßU÷@Ä ¶<(S\3_dðcYI(J~BÁTEjÿ ¿»Î{£6ßxtaÒ_ÜÂÙ¬ pïY¨ 0¸ú`,·Û p_oæ» h z ¼1cáÀ3ßÎ,æ`B¿²QgÐýfõ_,1¤¾»SÀâütl qÍpæ$ß»Zíû`p7ÞnôaÇÏãøT÷ø¦eñù F»¤].µîsÑL(ÑëÆGtÄfDo¤KÁL5hb¼ãî¹¹Úð ÍÌ1Aw67Èøý³O"xËr<ÿ bB#3Æïs j V þøÖñd7ºÑ̦ìÁà1Å<ç¬÷`_y]¢GºÞ5"!" ZêYã ]ºÐé'Nwy⯠*° £ ÜøÁ+Î =§àh8£pi¬uüþ{Àdz§¦aj4Òy× ðs¢Ç\ñ¯.RûÁ9 ?LÙlÞ¯3ûþ1Ó,$áçT!µB6U <ÆOOáÐâ ·ÏÃÉÜGÇ ÃÏ«0K1$ÅWqó¾³bVÕò\ZL7pÎ*kÆ=¼ÇCüò1VÈv¾4sæ~æ¢IÝC®?WÂ4`, àøǤÅJe°GqïY L' 3>f. sA¾ç÷XÔxàF¡ä»<P{@øsÁÎd5TBEjW]k4u/YT!À¦x|Ë£µÉµ*KV¾ûÍXÉËS jí«½)¶Sa?oî¸þðÙ¸æ¼ÌÒkÕP«:Ør+ÀÄV@ä-vh6³XyCnX ? 5LiòÄáïX G é® ¥JºÂÍà¤À/Æ yöC}5 kç²A¤h]3%ýÏàÛ¬F!R _ïXÐÀ4+ÐfÚ£æT#áÊa ¤{kü¯ pÜ¢ÞI1AYc ÁU×k;ÇE H íî wÆÜ >Îð!µæ à¡1X¤¿Þ3Ïlqfn¦ÀßÏM©ªÙÄÐ_X(BwüíßxxÃöÎ,teózÀ<8;ÃØf)ÁúÂ}|ñ¹Á·[Âf Ey6ëÚëÈ" MPV¸yÄ$¦ ñ@ ÂÚrHxÔì$*!í º|1<A!|kË«±ÀºÑ1SÏ 8 ɾ2²_xx[úĦ=§#Màt0"( mzñ[ ®ú¿ï ©Èì9þCôýä ®r bh®N-;"Æy7¥å¿îïXj»Q¿£àwX {poi¬2 qøpÇæ}ä´S¢ñ^°£ ,(Ũïr 7 ó{±ÚxÁaÁ%Ù¦|Æ=Eº¥¨1ì6©½ñy)³ßÙ¤Îw\®Íål@x3cüZ"½LYuMmÑ)&ÆÔ\§";rT ÂñÁ}Ì r ¸D¥wûK¾ù·ýÑíÊRÏ' D}å rç`~ðùÄ(,gUùrÆT¦ À«ðÊa- ®86:yç_µaIôj!¢Ã @½ØHòÊ#E §e6;0dñ"µ !ÀMMï¯9¬ ષ¾£ÁLâæ¡ìËlç½9ì ²Yû 1\ÆÊ;ÄÒT?Iº HÂ4 Øv^C+I*C1v¼ó´¥ *$ ÙÆ *È=ª/LKQv+uîçÛ¨ìÉ8ëQÝæÒ1ÍUÝg¾¾8éeGã8£¢àNwGç ì¥øƳm]9Þü°0Æ;¸ tj£ªÔîMr9`J;éýç0°é|cRDÐ;r¥aÐÂË{TªÛÀ¯bÚ¸ªíýùÅRôC1» è8JrÁz·|+;.¸®|dã ]æëÃ;¼±!ñÆ+mBfPèîüÿ ¹¢A§h/°'º¬ÚkÐòb&wqs]ÀLîàÙïX ¼ «d½¬Ö9\%Ô??Xm<ÉãFu Î[na/ÆñNP ±!ìEô°Ý,¨ %8äbþ©sãç@¡i×TIÃ@XZѹ»º]#Î 4 v # ',F UÇ H"y"ο EEÒO3¾m$ Ð8'õÉ2ëÖùqÓ~Y¸~ð8v!ÿ óÎM,Ðß 6 ñúh !H£Òïno¤få7¢l7Ö-Þ¾¼ÿ ×Îk0Ö)¬ ÙúÎ×; ÖQ¯CÈ·Wð°ÔNÖõxò]c¡ÁË ¢ÑtÄøDONw´çl"s\ð] ®±w3%ÐÉÒ'§ n:JPúPvì½UgÅ#ß¾ X :$UwM$â Lî &§»¡ô hf×A¾\W´ 9 Ò ¹õµdR©U{\¼ M µñDÒ#E*9 ÊÑD®ûÔ¸ iÿ ì÷RÕU¼ÝóiÆ°Î0¹w C¬4 a¢à ü&pç7Çç·ãOÃ@é1*°ÖQ:6ðp£¬#N4Ù¾üq8Áe`°Ðm` \¦ ¨Xä0GËØRÆû?o mþMæÓ¥ßNjoF§¨Þ7|5ÌGe-G0 ½ñ¬Ôè Uµv¼Ð !³m`l?Êb#cÐÙÇî²mAà4{VëDjBF¶úÈ_/8'XZûÁǼÿ àú³ùb,p\Q ÀÐqðñ|¿sð\<~x8Ænä\QcÏ9Q[ßýþܨ< E"SQ©÷aá@5Xj Åçf ¸¨: ÐsÁkLw PZ ®õÅ ,ÝAÓ¦@ØEUÆã+µBN« Ðu OÀ½`kX8$Áã8ÿ u#÷ËÏ7¼O9×öÉéã?S; Ëéç,õJe´ó7Ç4ñ&6£ë]uûX¦Ï?ß÷,Ü©7M;a|¸: B¼®ÕUbR ïk}84JS ó:~Þ¡¢VÆɾËGAÊp^y ê`$`é ( iux $l!8 ¢ atéMè¢=ØK¹Ñ Æi*MB2õ5&¦ÅäRHh£ºÉú©±#Vv-Ò)¯ëmÞ°PJ-¥ËBrí¶èÐNX1 ÿ _¼H]iPÉðGZ]SùÇ0zØiÝÒwàÑ~hºÑ«;>g9Ôí @TÞºS~hô@ÄÝçw]Fò$ÏtÕ> Ýx ñç@VppÚ;¼³õ{Â[> Tb<òs¦/3ª¿ ;×Å˯(÷¿Ýªæë¨ðØA"ëbO?§/?^·øû<à7ä6°?ja´DóÀþ3`&óögÀ¾°p¦ \#ElÁt}þÌ 8 ØÊ:ÓöL Ù(èdä_@¥º>æ²@¢Tyª´QÜíó A+µy»µÑÍÆËIü yôå DGpéz_óÞ÷âÊODå¿Æ"7 #C0ðpÝ&3¬ { Ä9×®jLª ©4Zhxy Ù÷óíH,<Ãn®¯Ì>À*%3H/Hßt?¬¤ sÉb°ð¦ñ±=\P ÿ ÕÁÃÓu+NA²5²G*¥ ]ôT&;Jèy& 5. ¥A çç¬:'`¾Õ d¤À6kÉýe# ¥ §{øãR 0wiG®nظ¨426 EïR½ Ú(û {Pì@ ¦°ÓQ ¡YÁAû1iAJóS©¯=î0kh*ò>¾yþìY6: O¸$ N§+ØÍwrÅkÜ9'ë ¹f¡A%õ¬SFËä?æ,ªð¨»£ûßxÛýófÑÙìv#A)f¼õ¯ÎC0 ±ó°úËÂQ¨²Î B˼êf$>±ÙWfõ¼ï\:¾s9ÍðÍ°?xVùÀ¾\sëÒ{ÁÉè0I¢d¿@|0Uw^s6ÕZ¼óéºÝµXâþÕÛã}ê \AùDlâpvÒ0 °ìíMýa KX BÑ>$¼ [ÐÛËÙ ¥ 9Æb6£öß/§Æ$8B¸ixt { ê«và x0J¡;;| y0{Õxï 99,WÖ*ZÎÊlá»×Ky'ýfVût:?\ Þd#}öuÎmÀ G0 ,X 2bõ5AØ;{ø×ïX<Æϧü·@`ð`$ó;áÀ,{s±ÎçÐ0wà½á_õ}`óñ e>4}Bñ¨3èÐU@tEÐYýÝmI}ùÁâ=ÝHm HÀ1òÄ ¤Sm¦Õ4kÉ`^4 ~°ËÖ=þÉR"+8¦¡@(åxÄuHÙÓëG8Þü óÕ¡¸Ô£78ß'xÀC»Þùÿ _XX»ûÃ198¡xJsLh !èþÿ <`[æÍÄüE_Õ=]ïÛÞh5Hÿ 8hõ Ç1_p|gg ]¹G| ùb-`ðO ðFÑî}dç4cTg8§T-jÞyjqö .µ¼4¢6FÎ9ýf¥v¼¯xÀL°¼éßêjåm1ªÝÝ¥Õ^/É7Çëj @ ûk¦ó Í3h$GV¼#z '÷ÆP³A÷=fÆÃ÷èTxf ¢u³§àìáÀáh@W\ ñL Ò±ÏÑ ôÂNu'f:1Ñß8(úüS0 Öà{ÄÒÔ<RAõÉÙáƨ軨¥ò ]%m È =` ¼Ñÿ ]äUÞDÞ=|+2 3tÙiÏغÒVÓj·Nþr] Ê ª ul%Ã,~K2¼G< w.ç'¼5é?Þÿ y³UÊÀz=â¦T%' p¿x/b(µ´gòg]Hü)P×Kå)ÿ p¢¡¨ú %×ß<cÀ-iaRÈ:áÞ ûÂ㧠&<p|þ@¬ü ᬠÃ!¿CËï$53èÊ¥ÑYÃ~ ú&hæÙà.mÖ:B,½½òäÖÊvÕ÷¿åÎ8´Òüõ qz½7#E¢é¶ õ¸Ø$Gûç çÑËI¸{eë^pDu@=â³ç o¾Þ0 !7>± Ã}ÃèŧÜt çMÑù"D@DDËÚxãvQcH)ºðèãÈøضÁzÞ°³ Ñ2»ìÅJ`Ðàëða5³5·XÏN¸ §÷ï àÈð!!ÏbG ¬ÐH 60j ï{þ;ÃL¯0 ÷ëö[ÂNFq(w¹,D¬ Ãüå?yN 6'#ëUÛ²$¼¾tÍñÍT _ï<lË 8( ïúÄ<ϬnãéÌÔWR2½¿\Ð?Xu«4¼"ÔIKp± Bhõ®Ânö<?§Si >5ÞðüëgQ Ìr~?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 13969 |
| Response Body - size: 13,969 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ {ÅÞá¥{æ\Óbð78öJÙתH*HùÖrϵËéòVÙY1rÉ;¸ô5Ly0×°f× jâ6)Ô#³¤è4hÕvbRÒÞ·=òÚIv.s®No+ƽ)`©(u¡º»IR;âôyÓ¿^©ðv) ©Óê-¬j n(ñsäJS¶u^¡5&fÌfÈI4¶=ùåÜgôS¤±Õ#,ös%~¶ ©ÎäK£¥µeyÓ©kî4î¼ìç ³µ}Yèy¹Þ«ñæÙÈU@è¶ÍM¸XÊf !ÞCÓOhxnWbK¶Ë]ÐX] ë2%ct4µ¼ÐÄ£Ä$i/«=`ö ©¼õ{®ÂºzB×µlÜa¬½ [íY·°ékã|êÒZ&;åKu ;³¹A;Q1ÎméÒLª·IZ5 F[å4 tN ¦¼ÚÄ8@òx]¾RÍì'§~]ÄaتÃÎú:°<#,,ÐǶyÙØ+°EÈÀiÛcÅFÙSåÕ!LãvfëSmÊæ tkÍég!JýÀó@:5aËYì¼n Ìܧ¢dA£Þæ|íqõÎQE/y ß;ë7¨Wkf2àèº&LS¯:] ëÏvsÛåÑKOU®Ô¶µç§ihÀH ´X ¡'=ù¤Õ¦ª¤G©xYGÔíôû¼ ¾2CÅ´æ£Á¶õÈè[íÎ×%´æsRÆÚî=³´ i`8Ô`ãK³íg6¡n{ò è¨ì*,Ìæ¹Õ!ðuz¿ióJ|î»üͼ۪È5èðcÞØ9ö§cRnÓÙÆÚ VfÝ&Ñg'7;.âzFùK·= <½z3ãfçl¹d§}sªZ̧ ¯ËJuæ½ tÖ°úá :'Ð4w2G¢Ùi§3Z¶î4ÀÃÛdÒ uqfòó°áGêÇ=äëÒæVøÍØèuÊÆ>Ã+fÓGE·Áfmm`¼ÞîB ¡Kú ®7ò0Îóy lKw`À"ÑËL ²%g´ß íæ$d\étË5ÇY66×dÛUDÓ]ߨôGW)ät5-1u"+¨°ã«¾¤]']ôó=N&{+MlÞÞ{¼ÂCÃgVOËÌMṳ́¢~dzr<ÆËQaÑÉ1æ+ÜÌÊò?1ioG3qìÌd3Ì 3 !ÌZ¿· 4æ<ÚYYÝd÷ÿÄ ( ! "102AB#CDÿÚ zyTgÚ¹©GMäõß IÇ#Ú¡X.t¶Y ËÆ¥u_m%,ß$?ÊøﺸÈ^3Epë W,l jg«Mä~üw«Ëÿ )xè\hÙu©YMPvAbúé}ê¥|ä£â_;\iS²ªt¿ D{FËáCixÚodòÉTºÅiäOÔzØ«Búie²ß)Ø£DûU k® ) Âá3x4¢ë®/ýRý®,1Íq¤å¹+) Æ9aä]ùy1ÊSq I ÷ªÝ[Ã.×v&]ý|sM.ýS¢ãK'ÚT@_M'f]ÖÙÕÞUTÈ¡ ÷²-ÝØÞ%ìþ>,þµnñsNTÿ CKeêµòô.t¾ÞÝÇä+¯¨!Ö©vÍê©jÒª}pÙù®%,=ZV±.4r,¶]sæ 4õi ü:hË"¤9JµjÒ_¨¼ Í&ÿ ~Í-z«BãIÙæûÕK! ô_MãM'l`^ÙdÜÛ²¸èË#«z´ôe¤eé²-îöWéO ¸Òv íuú+4Ó±+º»/qU½³É½Öü{{ø·|¿3j£4ÍbÒ2ÃI^ÛïGìC {. ±Yc#^ÊÁBãM;º0R¼ùeÖ«¡at¬·ÅÊ¿¿VQò+"| 2gM2fûl[º;~oå \Jx=¹ÓNÇÌ]ÞJÏû>Uw ªT(RT¼«Ç=åî"ô~¹oÿ ß²?½;X.4ÑÍ#æöíeMö¥IJ¸Ø¼r4¬ q¿ ï}>dë®;J(Ñ!ÓºGÍïäÅ\Ø©hHHÁ\®W?#MObØÆI÷å tµÃ?gOQV·ÿ ´ÎÃ?) ¶(kQBBÝ õhâ¼ìå§ézj þoUÛ¯©É6½ñë#1B.P¾¨_UËÇÎéǧT|)%äTÓC%'9B&&&&oó¾ãìI÷Ãge©ö~HW×ñù.SôܤÇç¯Èüȹ%Ùçy åÚ»»E^óçq®pÍ7zÉò!Ûæ}ÒÍ4ÞXÆ> \îûrýJ]µaT|Q>$ÇBêüm Ô9«jr.uÿ óÒiñ¶VÙä8NRTGÆqù)¸NÈ/z¯]!äE¶Ç!¶Ì%¯Q µFo·oûS÷Â?ÓôFhB¹FaÔê*c¿ / ²L¢¿ñ²ß%«]<¹ÉOƵÿ ã§ÆÆÌoG?ñÿ 1[ÃmG] bØ´!\çadªR£ÜèEjåV ÁìQN<Id¿år×Üu%Æ %ÂÌuܤE_D/àÃY<1ÌQÁÛÃôaï©ëpí!Àêâô\`ëLn5SØã4ÄÅÊðÙf¬Á2Á¯`¿xKñ!ía8vNN.EÆJ´ßÃÖÊÔ¶«¥"7EBå}¡Q,x<&AzhöÂ^¥ÇT_AJgÆê\aª,ø¥Ó ®åa£¥Êû`Éú3¼/sôÑ_öÂÄWúÂØHF ìö ôÂTÅña.Ñò2PÙ¤/·ÿÄ ( ! 1"2A0Q#BCaqÿÚ ?1¿¡ôòMÛéòðMý.Ê)Aµ"ûS£"þÝ?ÇÓ®]uÙx±½Wtã~èôÇî¯âe qÇÓ ³%.NßD¬IGÜÇ'Uß S'¶¼ßfXS ½¬Q¶fýÇÉgzé9j?»ü hÅ*ÓðK W(Zf8îÉ+dý8ر(îD²^Ú7tÅTkçbÈx«h×F5¦Ey+B\vprc¬~<n^z$Ù麲¢Q^z£ìô$\D³ ìpú½HôÛ=$¾Ls|!åE·ø Ú#6ü1+Qªö9Wr$?IJÿ ¢90±Æ3òdz$Ýè%yWèycú9Ãô¸hâªÇ³ ZuÒ£ "ÉúíG«D²^ìt7 Äþ«¶ËÚvrÕHÛcÿ ¤[äÄîËÑ'jÎiêFH¸Ú=U/ñ§ð¯Áê¨* j"ê6BZd%zéËõ/Luî^:úìj/Á(¸é÷âÔ 2j(ö³÷<pØÌskFHÓ×dY5CìÿÄ ' !12A "Q0BaqRÿÚ ?$¼ëùi.ÆÐϧ»Æ=büiùi?{¡ÈXÆEÖÏIlïGÞ´N夥á VCßcÏ¡IYxdª!+D»gOä±!ßFèI¾}tR,oJÎÙå G°¶D}ÎË3Ë´Q¯SɽãÚ)Ù?o¹Ç$N}£Í!¼Þ(ÉE çÈitfe2¼¥V$äáϧðúõ|Ë0ó.LÒ3oT&¯SÕ¦¼É GDºôÎRÎ~Âùdb iÃö>:V$úr½1!ù_ìP&/ä÷ âؤXï£EÉð8_$¿Ì>'Ó½Ñ nF8ñÀ¡n¥ ئ¾Æ+Üfóþ ¶% #~Itë(TȬ #[Ĭ«1® «»ÖÙ[ÈdV^æKy$Mn®(Ú ì<®HËƸÈNõc ÞIiæ5¹>ÖGi(Ù~Þc?ÿÄ 1 !1 AQ"0aq@¡±2BR#ÁðÑÿÚ ?ÂEÂsP*i¦\=-¢ºæÇI Òé~éÎf[ÊÊ7¤¦»ùÒ9LkE&Ma ;" ®|èê *Õe$ɶ³-;pT u6Ý9¯IűB³¸uLúvÊ ç]t6¬(Ñ ´þ¬©®=ÉGªÜY~=øåEÞ»§§úÑxFº$i¥FêH¬ ÐÒ_j¦².x ºèè@ /U1¥ÕDhÉ0 iª7M%¾Èjºuµ¤Í=4IübCUo¾¨·2B`îº ¾ ¢,E5í\ho¢¤æôÕ#ò" ªiÇÐÕGíãböÆÑÎ"÷öÔfÈÅï Æ%Fa[/ñºß·ÖC´GûÄb>ØGb ^æèдî§çàÐ. qe¿áOÄcGÜé®4ÖA ãTà6Sn×Q#î¥Ùk°NÌ9tÓ0¤ïK¬ßÄIÊ!8ÇOܬ$]"G)³pn«kN2.Û `0kx®D{&ôðRôË%PéUò 7ÙUú¹ Éò¦ö«¡¢w·ýÿ S»UþQl§f å Äì`Ùÿ Jw+UA Ñ"@â~ØF ÌÈþ·º.Äàæ7 ö#^wSæbW BLP_FÂ}5k B.£a\Jó¨ \E«ç;©uO?OYTû ;¨5 Zdu=HêI°²Ìë.¸Þªÿ ]eÒå$Gàú,ßtÀ°ÛÝK^ G+oÍQsOÖÒG¾_¤/ÐÑYßúB>B ¢TÖrÄJ5o©ú ÿ ê#iH·jçdÕJû)ò¦òtU ¦£Ê¨]@"TUSݺélWÝKþÆ·ò¯áï×gºOª¨P/Ù¶ ßÑÓ ê¡·ÜpÒµNÎÙ B ÇáP8s&èÃÞ÷YsA_åË^Csø26ÝAé< )\z;a˽hd]ÖjÓ óÕ½w@ ¯8Q~ÅÔ´;%=éÊ%QÄÒ{pïS\óÒ 0ìæåÜú§NeüO%7æeÎv% O2tÒ6µvËÝz(ÜÛ£:(·Uú "Ò(TætÄHC§7ª !¾NoàÎqª¶Rm¦åeüý-F8xÂÂ1«(Ý ÀLÜ Ôøú 3|cLhñ<hñÄjp²æSÄ«!Ý_C«"ÔßLi7¾j¼ê°D6+ºøË^% ¦#ù*÷LcxìO 4PIåFúÍÔeo¨Nsº? (}Ô´éØÿÄ ( !1AQaq𡱠ÁÑáñ0ÿÚ ?!f K,²åß5 çðK-= 8 ο/µ.wí¸=4 xMÁÉ©gC²bàw?kéÖO^ó7Ðo¥½-e®;¥Þ´ÔËÛ @Ëä¾3`«â³TäS+êüTu9ADV§¹ïpý Ëè R0ß|ÔPÐ-íÐ=å A@?.ó Í»ÇÄ 8è=-¿èkÖ>aiNen(¢éë,´P¯/?Ô ¸ÐÍåÛÚQC]/Ì^:p!®ïç¡lSlï(8XbdÁ(Z¿ïî ÷¡¹o¸ve½Y÷!£i4._É+°qгl ÞB;3$°ëï?ø zd@Aeô¨aV+¡eø¼6E.Rákóÿ &°z2Ù| ýÙIA¸ëè¤=÷M?2ô±zZüzïT"«ïÀvÑó±\ïCC¡ÐéXº !çÌP±EóG«ZnÞY¬wÓña¥¥ð0 BX¯açÞ)q¤$W:¢0, ûÍaåô 6XhMaOù ]£¼Â&FZµ÷ûÁ6ÿ è=8¥Ü+o Ó ¦YÏ=¿2â\yxÌM¥ð%¿ì³S~ ¬5=¦}PÝÝb½=á RÈ×ÍTh¯Ç SáÚÝÂ8Êå{Á4Ôz\¸u0R ï¼¹AE® æ5wg¿],๠ÃæBÕ£cï¡ñÓplh^ Lt õJH uZ¬ÇyÛ¯Tq>ÿ ²©¤!® ×K._à ¡(khp¸0îÆh÷¯½á k.-Öxù¿xEj[ z ô¾ks÷Y¾è9KÆxÇ y³Ï˺ÿ f©¤5ÐÔ]à×EÏWN ÙE÷¨ N}&e_oÇh7ÔL1èàmÝáííPF"ÛU,S T ð.Ë·KrÇ{é î®ð __9 YDÒ¢Rá¹^ð¨¤ãDjüK±q£_{LpÉB/# bËïâõ¿ä9·½Seùàräï>É¥c RÆã:tdAU(Å{Í#´u*\æC¡¯ &$lª@þRªuqê(=JK.ðLs¥JïbÝ6MQ·°q;`Wlñ|ÂI˵G8óÎ&:ôAîÛ¿[Ag½Pè|͹Úî®,×}¡ .T¥{J±A# Û S] /GT¾f²î'gm{pCШM ËKû@ÁBfÞÊ((ÖØDû63éíº3ø*¶öûâ/©'?½¼J9«ÊÅOPîá.{°vWYê+¤ nMüÀõEs£UÇ~#jÏi¬2Ú¬7'Ïlãá ¡ÞYjÍxò¡ æ6jÃÓ D[ia`ªãØâ¢kuǸ1 !=ÜE¾!ëÜçæD<Aè*Bz «%]ï¿Ê\5TY˺ûq\ Lv¸èB£þ,à·ØûýDu `âüüÃ-`q¨RN^)6Õút¨C°rç´ì¤âçm©û*ÌÆÍ/}°îíÜ%ñAè ¨ñ4¸nwߺï*iÃCºr À¿ÑcPÆ© àǽ@¯ý*?Éû ,Õo1ó ¼Ú¦þâÇ»P ÜJµåè ¹|@ ê,Û¿µ3Öñ1´ÊYn Ç@AᾺM¿×SLÑ1»ø0g)zBÉSníÂG¿sæ5³´g`ví;òHX2=ÞÚ -å±[ xÿ ²ü û¾@|ß "Pd ¨Ø³ÛG¦ 8¦âM¡¸uÒmÐÔ7ÓNª8úYr¤ &q4ÀÙåòïº.íx}»nÃdÆ]Ýþñ$»ù^ݾaiP)dzXÆ¥ð6B8â(¿x0jh7 tt#Z1¡ÜÔ¹jWµ q² +EA Ð÷/ïþÅÒqÓݯÌ*¾ch>¶Ãé§AòÞè`¬È æx;`>¬U+»^»>íÁeêË´ã ûsYk¬Úåßë)ZÜâøâ9ù +rÙg- Õýâ]óSYà+^\ÄL ÚûÄ``îXê¢ñ³ è×X°I²sÌi2&2Di>HDÖÝ`= eÁK¨ò¡Æ` *En HO\Í9Á;äß jpR¯>5W99SïϬ¦VâÆ«? U÷0²ÕhÍoª ]ıcQ27OÎ[¸8¸¤çz 5Ç߸\}0ýÞ3 »*/Ñí1ðÁËÏùç&<%¿´±R Ó÷ Ì&[·¬îYgïÓÒ Z9q`,·díwÞ;$*ø´Ö¯çN»B&5(7\}¸*xÈÚТËx0 Rì·ýKk ÁGþ Ñ v1 Ë*î¹±?O¥1_´%üÅÂÍÝÿ QÛ%höÿ Î.3ÿ B;Jö÷L,m%Åa¶ïÖfa¦ ¦±;kzí_Ü2zåwòè¬c 8Û©hø²sÌf ÝÛWúï8NYÿ %çÁný¸®}ækKbN&3/Bhªî(´[QÕKÊ´Ðkû¤]×9\³à§~¶PÛT o ¦Óºâ+» ɹ{ÄmÑ¤Ò \Ðèôôh]]L ªH®;´,Ïû¹R¤ bó¸æ/®qeÀÀ5¼ü{Nö¢y |hc=ã²"«%2÷¸ªñvWEÔ° Ùò7[ßgHLãuj æav¡´/ Ár1M!¨CSH:@¸¥Jþ ;.Z( CQèÏH n³ÄÒhòÄ©ªpã8Ùл&ãî A¦ñ¬½¢X5µéfO Åmy{B wÐPÔ54t1 u©F,Ü\?HãÄÄg¤¡Ã ã í»ûë a¯ÆaEX.>ñQ9V m8ÀgÄÊN fÇCO¹taâ8Öð§y¸9Ö:K£ho¦N¹1>NSk¡À ^;Ë Ì׶7Ðsq&!¥ly©G=Ȧ,ÞüNMS}`FáÉÞ$NgGãÂf;ñ¹T®§Ì · #g Pé¤7Ðèt©/}Ú9ÒRA.Á«kÏrïµþ¥ ¿Û£ 6àÍLÏ ½3n4j@ VÑ2ÑýÃmL sH@Ó`ªe½1Ú§ã·Ô±<^!aö»Çõ@&kR Ýeqt uÿÚ ©¼Å· ×Ýðz ¥¢àu¿ªawdÒøCÉþ&!ôý@6ßMí[T¬D #ÄÅ¥KUÅ;Ð×âBò´fbTÙ5ÚþÂj¼·KÞMÈÖáõc©A Ó*OÙmW°úÁ²Q*C븥iÅñdªýRq¸aÆ%Ñâò Y´Mͤ¶FÚóð÷IÄ£%ÍPQæbàwùZæãCd'Щu2ñÿ B| ~?] ÷ùÿ <ÿÄ ( !1AQð aq¡±Á0ÑáñÿÚ ?ÿ Ø)Oe®zã㯳,_ÏUmù- ~#Z*+%À9õ¿ ϾÏNqo,h ]ïëÉce0ELîûÔ·^S¯ÌøQPÔ¸<_YÙ<TBLÅàþüøçPú´aæQh!ÉÓ ®&9Ñá©Öü÷ß¾`]D¢â0ú´Ðjb®ÉYzCÍÆbßÖæ)Qúãñ<¼Ó=ñë3sÞûô\Fûâ 1UÒG=bs ùI ôÖ¾ø'ÖuE/Á¤&rà qññ.Xâ©Éï[eã±Wí¦Dà I{uZ76µ¤"°+½âô¯û¿â;ø4ÌÇeïÙ¯#Pjá/¾øûEüWñõæêV×HpÊ?Á6Ô^h8vþ~~¥¯Lýw¾Ø_Ìæ3u_ÜG߶¢ ¼ê:FIW¨*¹¾ß´3¡Å±ÌñÁ)Ý_ÌO{'¼³Åm7e È©òÚW¸dêd h¬þ%ée`h¤míWîzCU(Äòì·£öK¨&Ïxj¹ÔÈzLßj]³L«m]ÿ ÏMBË¿©|á¯Wý~E9<øÆð~Á,Tȳ¶pD: WÐxFDë_°9. kÉÿÄ ( !1AQqð a¡±ÁÑáñ0ÿÚ ?´4à-Í«ß¡ p3lm| |G«YR¥{yW¿{ðvü`¸1à k)£*:pêó§ veË . f·wó ÑÁ£o -2ýqKåÅÊXó%Ô6me¬#BÙóç½ae¥jð=PÞiß}`¸àÍJ:Fé4`áÙù×￨¥M\zÍm6 b°õCÉËàZË.X9tÌ 9|CQÒ¼ÝóÔÇ(x8`W¬sÿ %FÎaª9ý09F~Ê ÿ Q²g ¡8#TÉD°ß¾rý½ oSN×\|Áó0ysrëûìÕóý ´fdjãÓ»»¶fºûi [T Å]!½æO ¤ÓÂB áÒhÆÏ=}óE^¦Ðª%{GëßÜC飪ÿ ÚvõÓêÁ4*ù+î«óýNøĸSüµí´ú°B õJÓÏxïÞv½»ÞóÇ¿ì\«ñß}!pV+X)WÞ`V Æ· *ºÍÖþ#/ò9-Ü÷¤¯!ué5m°ôo( õLÓÞ; ßTX±dÖ< ^" zX÷?®ôÐ WÎß©GÌúG3â éöE=cë¬#ª][TðJbÈ%ìJEErC/Ô°<å C0ÛÊTêK"¶¼õ» (síYà*"®~?r¦VË0V&Sx@Ëxß ªzüDvÙ¨A4ðÿ ÿÄ & !1AQaq¡ð±ÁÑáñÿÚ ?P®:PRÀ0{sÞ7IæUáz9Ü6êÐáÀve8Ö@0 cÏ}tÃ(騲ðÏ ~°ä]å|¹= àCU¡B ¿×s6hÑ[9åß÷Ë°ø± ox- °Ú|gX «B f°äÒbUÏ(ZáË ù~=Ø£é¯y¦ø´ýx ¬'Ð hàÚ=®¹È×}*¯hRq ÊÔ§Z#Eº5NÓ!UÑíÎ³ï£ 4¿ ^r8ÃÍ¡@ÿ ÒyW^×}×y1]5O¼5ClKa|^2¥¦(ìòzêOä~ò<#\fÈ:iw8êrzÎ6[º'Ý×Î>LSNÌCmfàÂB·T³N¾$m-P5ZR¿, @<cÃxi wçé,T@B®èraIÌk8&ÍÇçê;àRKñúé§4C¥e㨽'.P \hñãY!¬ï ùaßãñ¹ÿ X'qëçÄ Õºuæ|Ls!L´«[U½róÝÁ³=Ù¡}äöÁÑSæYÇûÒ*;PùùÉÙÍKõJ\ÅDèt8@½ªùÊÙr'«3Vä7ÚM&%Àk½@ ©F.0üÆs|â£ÖOO L Çò «Ë@rX =êäò°¸B¼8ã±/&+ªÏ qç§Àñò¡/.µ@<~4`ñÓñÛðµ? 1 s. wê@" ®÷%j¤ G9pä1¦[¦¢ZO<@XN×Îîi×Ö>&N¯U´XJ®·®,¯N ÖSfQ˨N¯Æ µ(åx mÒMÌ@Q ÍïÆh¬qq+Xõɨ Ü«Ú¡N<¹úêÒ=-¼¼µÀ¡ÄwxÐ ¤¯-äíªjÞlÀ¶ygççy0ÖðDÁ Ïòg#ðãøQ¸4ÖHÄ:YjݽíÊn-_Ö)°mAèßU÷@Ä ¶<(S\3_dðcYI(J~BÁTEjÿ ¿»Î{£6ßxtaÒ_ÜÂÙ¬ pïY¨ 0¸ú`,·Û p_oæ» h z ¼1cáÀ3ßÎ,æ`B¿²QgÐýfõ_,1¤¾»SÀâütl qÍpæ$ß»Zíû`p7ÞnôaÇÏãøT÷ø¦eñù F»¤].µîsÑL(ÑëÆGtÄfDo¤KÁL5hb¼ãî¹¹Úð ÍÌ1Aw67Èøý³O"xËr<ÿ bB#3Æïs j V þøÖñd7ºÑ̦ìÁà1Å<ç¬÷`_y]¢GºÞ5"!" ZêYã ]ºÐé'Nwy⯠*° £ ÜøÁ+Î =§àh8£pi¬uüþ{Àdz§¦aj4Òy× ðs¢Ç\ñ¯.RûÁ9 ?LÙlÞ¯3ûþ1Ó,$áçT!µB6U <ÆOOáÐâ ·ÏÃÉÜGÇ ÃÏ«0K1$ÅWqó¾³bVÕò\ZL7pÎ*kÆ=¼ÇCüò1VÈv¾4sæ~æ¢IÝC®?WÂ4`, àøǤÅJe°GqïY L' 3>f. sA¾ç÷XÔxàF¡ä»<P{@øsÁÎd5TBEjW]k4u/YT!À¦x|Ë£µÉµ*KV¾ûÍXÉËS jí«½)¶Sa?oî¸þðÙ¸æ¼ÌÒkÕP«:Ør+ÀÄV@ä-vh6³XyCnX ? 5LiòÄáïX G é® ¥JºÂÍà¤À/Æ yöC}5 kç²A¤h]3%ýÏàÛ¬F!R _ïXÐÀ4+ÐfÚ£æT#áÊa ¤{kü¯ pÜ¢ÞI1AYc ÁU×k;ÇE H íî wÆÜ >Îð!µæ à¡1X¤¿Þ3Ïlqfn¦ÀßÏM©ªÙÄÐ_X(BwüíßxxÃöÎ,teózÀ<8;ÃØf)ÁúÂ}|ñ¹Á·[Âf Ey6ëÚëÈ" MPV¸yÄ$¦ ñ@ ÂÚrHxÔì$*!í º|1<A!|kË«±ÀºÑ1SÏ 8 ɾ2²_xx[úĦ=§#Màt0"( mzñ[ ®ú¿ï ©Èì9þCôýä ®r bh®N-;"Æy7¥å¿îïXj»Q¿£àwX {poi¬2 qøpÇæ}ä´S¢ñ^°£ ,(Ũïr 7 ó{±ÚxÁaÁ%Ù¦|Æ=Eº¥¨1ì6©½ñy)³ßÙ¤Îw\®Íål@x3cüZ"½LYuMmÑ)&ÆÔ\§";rT ÂñÁ}Ì r ¸D¥wûK¾ù·ýÑíÊRÏ' D}å rç`~ðùÄ(,gUùrÆT¦ À«ðÊa- ®86:yç_µaIôj!¢Ã @½ØHòÊ#E §e6;0dñ"µ !ÀMMï¯9¬ ષ¾£ÁLâæ¡ìËlç½9ì ²Yû 1\ÆÊ;ÄÒT?Iº HÂ4 Øv^C+I*C1v¼ó´¥ *$ ÙÆ *È=ª/LKQv+uîçÛ¨ìÉ8ëQÝæÒ1ÍUÝg¾¾8éeGã8£¢àNwGç ì¥øƳm]9Þü°0Æ;¸ tj£ªÔîMr9`J;éýç0°é|cRDÐ;r¥aÐÂË{TªÛÀ¯bÚ¸ªíýùÅRôC1» è8JrÁz·|+;.¸®|dã ]æëÃ;¼±!ñÆ+mBfPèîüÿ ¹¢A§h/°'º¬ÚkÐòb&wqs]ÀLîàÙïX ¼ «d½¬Ö9\%Ô??Xm<ÉãFu Î[na/ÆñNP ±!ìEô°Ý,¨ %8äbþ©sãç@¡i×TIÃ@XZѹ»º]#Î 4 v # ',F UÇ H"y"ο EEÒO3¾m$ Ð8'õÉ2ëÖùqÓ~Y¸~ð8v!ÿ óÎM,Ðß 6 ñúh !H£Òïno¤få7¢l7Ö-Þ¾¼ÿ ×Îk0Ö)¬ ÙúÎ×; ÖQ¯CÈ·Wð°ÔNÖõxò]c¡ÁË ¢ÑtÄøDONw´çl"s\ð] ®±w3%ÐÉÒ'§ n:JPúPvì½UgÅ#ß¾ X :$UwM$â Lî &§»¡ô hf×A¾\W´ 9 Ò ¹õµdR©U{\¼ M µñDÒ#E*9 ÊÑD®ûÔ¸ iÿ ì÷RÕU¼ÝóiÆ°Î0¹w C¬4 a¢à ü&pç7Çç·ãOÃ@é1*°ÖQ:6ðp£¬#N4Ù¾üq8Áe`°Ðm` \¦ ¨Xä0GËØRÆû?o mþMæÓ¥ßNjoF§¨Þ7|5ÌGe-G0 ½ñ¬Ôè Uµv¼Ð !³m`l?Êb#cÐÙÇî²mAà4{VëDjBF¶úÈ_/8'XZûÁǼÿ àú³ùb,p\Q ÀÐqðñ|¿sð\<~x8Ænä\QcÏ9Q[ßýþܨ< E"SQ©÷aá@5Xj Åçf ¸¨: ÐsÁkLw PZ ®õÅ ,ÝAÓ¦@ØEUÆã+µBN« Ðu OÀ½`kX8$Áã8ÿ u#÷ËÏ7¼O9×öÉéã?S; Ëéç,õJe´ó7Ç4ñ&6£ë]uûX¦Ï?ß÷,Ü©7M;a|¸: B¼®ÕUbR ïk}84JS ó:~Þ¡¢VÆɾËGAÊp^y ê`$`é ( iux $l!8 ¢ atéMè¢=ØK¹Ñ Æi*MB2õ5&¦ÅäRHh£ºÉú©±#Vv-Ò)¯ëmÞ°PJ-¥ËBrí¶èÐNX1 ÿ _¼H]iPÉðGZ]SùÇ0zØiÝÒwàÑ~hºÑ«;>g9Ôí @TÞºS~hô@ÄÝçw]Fò$ÏtÕ> Ýx ñç@VppÚ;¼³õ{Â[> Tb<òs¦/3ª¿ ;×Å˯(÷¿Ýªæë¨ðØA"ëbO?§/?^·øû<à7ä6°?ja´DóÀþ3`&óögÀ¾°p¦ \#ElÁt}þÌ 8 ØÊ:ÓöL Ù(èdä_@¥º>æ²@¢Tyª´QÜíó A+µy»µÑÍÆËIü yôå DGpéz_óÞ÷âÊODå¿Æ"7 #C0ðpÝ&3¬ { Ä9×®jLª ©4Zhxy Ù÷óíH,<Ãn®¯Ì>À*%3H/Hßt?¬¤ sÉb°ð¦ñ±=\P ÿ ÕÁÃÓu+NA²5²G*¥ ]ôT&;Jèy& 5. ¥A çç¬:'`¾Õ d¤À6kÉýe# ¥ §{øãR 0wiG®nظ¨426 EïR½ Ú(û {Pì@ ¦°ÓQ ¡YÁAû1iAJóS©¯=î0kh*ò>¾yþìY6: O¸$ N§+ØÍwrÅkÜ9'ë ¹f¡A%õ¬SFËä?æ,ªð¨»£ûßxÛýófÑÙìv#A)f¼õ¯ÎC0 ±ó°úËÂQ¨²Î B˼êf$>±ÙWfõ¼ï\:¾s9ÍðÍ°?xVùÀ¾\sëÒ{ÁÉè0I¢d¿@|0Uw^s6ÕZ¼óéºÝµXâþÕÛã}ê \AùDlâpvÒ0 °ìíMýa KX BÑ>$¼ [ÐÛËÙ ¥ 9Æb6£öß/§Æ$8B¸ixt { ê«và x0J¡;;| y0{Õxï 99,WÖ*ZÎÊlá»×Ky'ýfVût:?\ Þd#}öuÎmÀ G0 ,X 2bõ5AØ;{ø×ïX<Æϧü·@`ð`$ó;áÀ,{s±ÎçÐ0wà½á_õ}`óñ e>4}Bñ¨3èÐU@tEÐYýÝmI}ùÁâ=ÝHm HÀ1òÄ ¤Sm¦Õ4kÉ`^4 ~°ËÖ=þÉR"+8¦¡@(åxÄuHÙÓëG8Þü óÕ¡¸Ô£78ß'xÀC»Þùÿ _XX»ûÃ198¡xJsLh !èþÿ <`[æÍÄüE_Õ=]ïÛÞh5Hÿ 8hõ Ç1_p|gg ]¹G| ùb-`ðO ðFÑî}dç4cTg8§T-jÞyjqö .µ¼4¢6FÎ9ýf¥v¼¯xÀL°¼éßêjåm1ªÝÝ¥Õ^/É7Çëj @ ûk¦ó Í3h$GV¼#z '÷ÆP³A÷=fÆÃ÷èTxf ¢u³§àìáÀáh@W\ ñL Ò±ÏÑ ôÂNu'f:1Ñß8(úüS0 Öà{ÄÒÔ<RAõÉÙáƨ軨¥ò ]%m È =` ¼Ñÿ ]äUÞDÞ=|+2 3tÙiÏغÒVÓj·Nþr] Ê ª ul%Ã,~K2¼G< w.ç'¼5é?Þÿ y³UÊÀz=â¦T%' p¿x/b(µ´gòg]Hü)P×Kå)ÿ p¢¡¨ú %×ß<cÀ-iaRÈ:áÞ ûÂ㧠&<p|þ@¬ü ᬠÃ!¿CËï$53èÊ¥ÑYÃ~ ú&hæÙà.mÖ:B,½½òäÖÊvÕ÷¿åÎ8´Òüõ qz½7#E¢é¶ õ¸Ø$Gûç çÑËI¸{eë^pDu@=â³ç o¾Þ0 !7>± Ã}ÃèŧÜt çMÑù"D@DDËÚxãvQcH)ºðèãÈøضÁzÞ°³ Ñ2»ìÅJ`Ðàëða5³5·XÏN¸ §÷ï àÈð!!ÏbG ¬ÐH 60j ï{þ;ÃL¯0 ÷ëö[ÂNFq(w¹,D¬ Ãüå?yN 6'#ëUÛ²$¼¾tÍñÍT _ï<lË 8( ïúÄ<ϬnãéÌÔWR2½¿\Ð?Xu«4¼"ÔIKp± Bhõ®Ânö<?§Si >5ÞðüëgQ Ìr~?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14228 |
| Response Body - size: 14,228 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ùóN÷¨Ãp` h5MM À ÀO ðÐ0Ð3á `C ÌÐy&£ ¦è(À(À(À) ðÔÒy0Ðxn¸áJ<üÅQ\ MM `jxnµÚXà½(*+b:ÇB°Ý Ýê~|«<N5s:§È:ÇUr é+òó´°âóÕ?iÎk½ ëÓ²cÛLñN8FÚÖsã\®=b³7ÉJú »¥ÕÊòÏçéÞ âì9 ÐqXu!ID[czιer6´qc=È´:7¿#Ùѹ*%Asíà§6b*çW8u½¼© 1:çºr7CICZUÒwN½eo"Ì·.Y`ÉÛ ù%×Ëï;ZÐÕÊÕ¬ªg ó³hë49¯×ºi_G¯£ëJÍ¥Q«MzÇ.ÎH÷¤©]üÍÔ1)*ÙAÓO¾7µâäç|§Ô|Õó6{Ü<ÝÍñÅÚ=)*Y¯:Yɪ¶Çò¾GWçö~+G¿YÒ5zæyÐ^T·×F ¼_ÂÉÍù¿øµçêôùkÏRRtÏèÝæò®øg&ÔÙµ@çå%°Ëfûϼ¥zm~G]nJ¾aC+ñ4¥Øm«éôìJÅåôf*¶ (ç DW¡ÜWwIͽòÊÈ%a1×LI«vwX]ÊÎC£ xj$ç¶å«L±ubÍÒÅo:ºcÊF¥¼¤&Bz (ßNf{yM*éë+ήYÍaE}²}ÃÃÐ ºµ_3úë$hlR;é~^bçÖttstvKÉñjª*Ãsjj¿¯Ë<RxtCcQ:gç|ò¯ ¤¯%p@ÈutÀ5\lüijUSÕEÅ6Ì`²=;ÌK ¶JJç8Xê¤té¦ÂèS£åë,M³}iÍÚO2 0z``=ÌLÓé´À4À7 Ea@a@qFM³î ÜP ð Ì ) ÿ ÿÄ * ! "120#@BA`pÿÚ ÿ Í+ù8<BþJuZü¿V T¯0µ+d-ÈX`) ^uBã\Q) nµà ÙÉj¨WP#xã©¥Åö ãì °<{e#¾æFc;Èç[v+ÝÂhqo ª«e ÓS.CÔ>±þþèáj'U:N®Ç?SábÑ"Gdö²HɲäÎF")¨¿L½í¨Hâ,ë½Àn}ß}¶ ËO¯=¾ãP¸ýËUê]¯ÀDvà @¥N#âGî` °Ù®5¦7榢®Ú²äemÂWµÚÑäÆûWEW°ÀñÉê ÿ .q¬®ü!*¤JÐ%Xú·´ã¢ ¬S¤ öQì8¼+ ¶â5*(Ý´`Ü®è9 îÂPJº"@Àv»/)Öõ N£.Cøî«æ¶ nû.TAò_Èul2cêr£`Ëóbcìa=Áqp]u¹þ ©Ê_¢ê~tb# ÞÙj!b¿ÀÙ:vVFüN#1öjºî ûúÊ~CEÍedC ¥ªWE7=Î?Ëb.[ãTàé¾Eäj0¯ _U¸ ÜáÊ9( ëu°ÛV!Dn\U cÑÖõä¢=hû j] mòE¦cz¢Àp¡@ E{,Æÿ "ÜK¾Eå`Î_Ô$v¸[|µrü]®êþ5ÈáC4&z[µÎfï¸Ö\±ØÜ'# =ÄQ v±ÀlØDÔøÚ¸þåéÎÉäÐʺ'°ûâ ÷ ©R£¥{K2AìµêGp U/²þ· svâüQÇÝHnËí2®QÖ0̸çÈÃbøïúN« K?Ø_P!ñ¸}Â{8fÆÅaxíá÷ NW ´ 1Û5ø¤_î%LmÆrÓj îvZ¼WéÇdútÎPd3W@yÜcÉ/W9 0f.à 9K^Dù?r=§û¡41G±c\¿ÅûÐþ g)v j\¿ûßÿÄ / !1"A Qa#Bqð02¡ÿÚ ?¿u«WíµjÕ«÷Zµ~ËVZµjÕ«VZ´\Áºl¡ÂÂZ´\ÖßÙC_ÊõQVíZµ6@ Ç<´7ÏótÜ°åê¨Ó ûQd Jy ÷ÚÈ}ð¢Ê2>5ïb*ÇËÖ7Z\Ó¥ÌhÎõ3Úý~·B|®¤±¹£ý¨r(°@M1{¼)È#Kê!7Wu64¼øþ}V©"qul¥ÆÑÝ#Xß×Ô¤¦Ì ¹äð£ÆgW°~èÀÐ8Y )ËOMü©5´®°s÷;'æýEG5I<©atG\i³ º5(§Ú.L À3´ìÐQËû§Üëg*Ièß]mj Èe³ÂüE¤B9Ñ *W2A²cÁ^´ZĸìW®Ðâý'æ´rÊcü©¶îb$r£ÊÝbËmíÙGñæHç ©Ï*~ ·Pkáe61 ßá`]nf¡ªfÄçè¡d] ¾ wÙcùåH<©ºcûJÙÒî[XÖ#u©DÖiíR Áºö´) ³J,KÝC,ÒÔÜ4näì6ù*H£lÑ59zMÖ xMÄ{çVÿ /(á°sº t°n¥É Tx= x³äìiO/SeYÒÎTXÚSX Ä&C[y 9Ø%¦#(!OÖþê8L§¨õ3;Ú@kÒ|ªÐ/õ Í´÷ ¦È.:#å3 @û¨¢ê¨¢í×ôåFD/Óà«T8Í-*`è$j*);£}¹ n»V> hYQ<&ÉîYÒle æî¿2Rßú Æ6j²W4©GK½ »§çt|© 4Î1ªTm;¥6&ÄÂ¥H²Ô!×÷Qc@ð¤iA©R©¿ÑºO®ÝÂôÎsµ<¦ÄDz*Uó¥J*T©iT©R¯xT«úóÿÄ $ !1A QPa"ÿÚ ?ýUWùQ³ÁEp²3í} è¢c-*Þ(¡éþÉÉÚÑ|] ú2(¡ª:èlLNÊ1 N:2Ó$ElzÑÇ´bCb%C0© «,?Éé\ýÒFÄ*òO SÌxli ©ÉBÑé%/p´;±phÆôB mfBt&w¶{JÆü$YÙÇì#Oe£%ÅdV»,LËCØÐeC߲űi³h²ÈðSmbÇÞ¸²Ç´-öEJÚ} oáfEÍÊQ þ§ÿÄ 6 !1A "Qaq02¡B±ÁÑáðb#@R`pñÿÚ ?ÿ ؤþ^÷+ }Ô½üÕá²²LàªÜg#1îLp÷¢¨ Ý.Ôd À*÷¦J³kâ$ ¤G ªö|µW8CÙÄi 'Ôê¡¡P0¾ájcD6nwS¬ñÍÕ(tÝi¼f8±åImà¡Òµ`i!®PuäéP¨;²Çf6dµß¿öT-øG©íò ÝDdÆU¶%Ð:X o~Ïõâk¬Ð¸«" h[}¥ F §1'ÐÉ.YÑYu}wqk}× úöF⨡ 7¿ºbQ÷Äc~CC{aNò¯×wF;©Eĺ0«6 ¦ñ27exV~ÑÍ »£0 ê'wV$ ºa ÁЩ@hUºµ*+$£S<ÀE.®N/;³òÞ8u¹S"¹ÝYÜKt$,FêXæ ºÌèOci¢ú}lh¼¯^ë¿9Í"QÑN0L ÕªµÙe_$ ¨'^ è6ã=&Áì @wâòÅ«¿.ß}>K+¦f>,xdOä²¾|ÕºLöÊ;7üQmÇmM§ÓõNë#EÂÖôB1Ù|.twD\M!=¢í'IRèÕ_<-¶öeî=ÝD;ººX(ÈÕï¶p« ¨jwN«£¦4Óè2Fª6} aaoÌ"\óüE»gïâFe&'Ç)о"ÏÏi³sL0~H3dû ê§Ã¬yAÂ">ë_E$åïr´AN¡þ+ýÆbê .$ßáqÊl¦æ\ªôVPêE Dá §ê¤m ´ád@ Åí84?%®´£ °È=T}UméiÛB ZëÙ\,Sv]q~ª Y^` ×HMcõ\@½ÜÕ ú®<X(¹ÏëáÃ'ÍJ¾YÁÒ4ZÉ6F+Oo Ey)Ìiù \O¦[¥ÿ ú;U®V~¡tºá\$v_¢z z@4Ï_²0>9³»²ü$ùV@]B) ~ÈÍÍ '¿T¤áqXnÃg§M 0z³góC¦5R pÂ5ß>P1 Ý5ïÉ0=ïªiu VÞÙË÷ª¹¿Ë²Ð ʳ~¨Hú# 4Ö0@ ýZÈ! ªÅÖJ.3Õ PV« < ÝZÒ̯åz##*¸FëÂ*ÓÌód æ wdÎT,Ȫ_åÍ"ûÅ£éÞ#¾àayWÈfȸ]C;ó?¢µ#Uä'5ÂCIð´ÞâFï²t]¼ªådÙê«|» [¸x´Ç³hÝÀfàyC"+%qí ÂÙBh(1w* v9ü·¸ÉÐwO`lEü¿°«â@pî¸rP{H{¿Âhu,ÇHÝEJÙµñ/1Ûûü©dp_² åµä®W_4@ÿ o:¡ÕõNvª2±Ë êFW+fó<Lù©Ä(n9p*÷8[?i'ÌJ/¢qÚ7h')£Ã«ðêµ×ÜdOw}á:Èâ ÓjU¢oÓÜD8²x9n«ÑACöWÿ Ô ÷ ÉP1ÿ ÿÄ * !1AQaqð¡±Ñ Á0áñP@ÿÚ ?!ÿ Jÿ Ë©R¿ójWþ]J*Wñ©_Æ¥Jü*T¯ðT¨°ÈÊÿ \âë½3[u¨À<2¥JúWòÑÍQþ2Iïqt¥\©n¾*T¨Ò-æ2Ýn@E !Ü}~ÐpèÅU¯:(±Í1¤¯âiwÝâ·UèmjúØ4ÿ UãåUhôÈàhN¬`û ¤b¥ ¨Æk ýDÝÙk× >©z#eÖ ¶Ñ®Lÿ ¦8£JéÇ_^Î â8{{þ¥$ª³¦"¨ÒrT¯àdËA{Ä´ãí0§ R© l¾3K¸]yMú|¹ÚMÏÞU í¥°7\iÒ¡¯Ü©R¾·è½Ä -:~}⣰ÂXò«Q18NõæjV½²] !ÇÎÜjdPÞu]\Ï8öAtk[+Ì¡©R¡LÐqurÃÉÓè .ªþu%9ÃZØY¬g1YÔ«þ]~Ù¹mîÿ ¯l0 ðatýµÐmªéį LµÄb¦l\Q= -Ûbç xÜ XÇlÅÄ- ~zÎÓ_Äy*üEÐ]ï¢}@ØÕ.ëþÿ ©) k¸?E#élü;DÎñ~¼¼Ü`9§ þ¥Ø!ÕûÚN½5¾h i²µí<'T@óÓ S úå(¤g´s§Ü®Û=Ò!gN¥<ú½±ÁYqÅCkAà'^%@5t^¿oêdÊó%è¬ ØJí Pê×Ypa [[ÃQ+T¹ÅâÏù ÜßIP#Kv¼wñÇ=åLcCUÞPâþçá"ö+¨,¸1CL¼øv1ÚTåߧ¼`f`P·dNeÑ*6g¿F/0É®eµuséùûtERÐ6;õûcÚ òTXÈù°)ÖfëÒ¥âë ¶+äý}D!Õ*& ⣦X<>lí¹Bp¥6Ðï¯6ú%P)mà7ÕÜ4'\tF£´²¬Ë¥;Kà1õàB F[ Óì¦Y%!Y~ó7_luíä`Ug'>Ó^WgîþÑ¢ÿ æ(gÐ!±N· zíÏbvýLJ@Í_}@ÙTlEìTjdn J5=u/4x(C}>°T«ikeà}}%tâ]{MK{J() bI6 k¿Æ"gÐóý0§4éÀuþã|-*¯Üºùä,Ö£5«iJ#7Wn}æZô4ÊåR¬¹ºûMF¥ik²Îæ2u2f £\í¨ÄÎ5gnÿ Ü AêJ¶K`v׸ÁKµ¾9ô;þG B©Tx h'Ëé ¨ÓZÌ ©ÂáÅu õéħ»©W^OF¢ áÓ JÆ0e ¦^MGªëÞYß\T~o.E¹ ¯(¬ ?®?¹vÔ8»^·/4_-ã}³~зºÊMôcêóþÍB¦Îò)Ì©ãb´*è }içæ%ìi ª9âPb.]g½å °2'V¶(þ¢[®ÐhqÀínÈVW6¸¬ÝÆ[¼Þ𰤻 B/X, ù ±OäùQ@oW¶%âÔsùj$l'àa?·Y&|G,-õ{1tÕauÇ<ÍQT»ÓßSlMq{Ù̵`Áiw¶Ìçá.zÕ³goí_Q^ïâ×@»´8WLÕKºÞsInï-ÂõVìu2â ª mÛX ×:ÛÉÿ %Ìa.4\0GxÄ¡/æ'%L _ŵxjÏÉò¥Vó¬ ¸¨à¯aI1ýÄlvÎíªOÑ`Æo:Ë. Ê ÃXver¶Åñ17G :üâ°5~ -Æûs5£±¡8m=ëïCnºµ3ÄÖ®|Kn`BÑn8 2¢Ú/båHÑWyô={ARòjvÂF¨£GGYÞîßJ0 YV®îzvçÕ_C®ÓÃõ. ¡ ³°Ëåoç¼%àñÛ÷ T;Jk3HÅÏ ´|ÅNùc"{?D$]ȺVN°áiA} n{Wö[ëÞXK_¾ãgÐ;{¹+æ '¬ÒÞk2/\ 7->Ç1e®V÷Zéjê¯akãYîË>ah ôV /XÙY- W|<ôªÕTâá×¼=g>´±³u²ÔníçþÊ2£W{µj±fú~³0.\JT~ã××Æ%JÁº% ¯ ¢ðë¼qûld=1ªõéSÛð¾Ëvz}¦kG¨~¹a`áÈb°t WCj qçpC¡«ôçuûP=ÃY OÌAl±´(S^´ñ_:Ô°*¸"¢«Z kïU\óCuN °Æ 44ö<Ek¹] t[w >0SL{·ÐÆà¿!Ù|óFÁ×ÂZº½\öéë1HwÝ ÃÝ¿äçTýa©@ÖcR)®ÚßYkzªyû@+Ch 7îÎBJ¿yA_Ü®Æ8 cµwNfÕ¯¬¼¸D¥ès (C$߶Ù)GÒ³-(R9yélr¿ÌÇ1Í[ â2³A2Û´[n ½?pfà9u*xÖfJ7Ý*¿«WR^·õÍHUbúêh «7Û8×?@ªMd²ÊéÆQ6äý0vV&Q9þÔº¢ÆAÁëâ¹íSLÖk9+Æ\Ëm óÇ51dgn¥Ê.®ÔÔ# 쫯=4Ã/:õ~òý!l¦ï¦®2 Õï>¾Ó2ZÕ[;T¸3Ùº[ð6 #Ìáª4¯É¬Æo¦æ%KCP". dÑå¢X·â#f ¶ nìëÛo·Ð Ý7·-^"Ñ4ºQ¨©«FºJ î·ø ĹrÖÞ§Dðcn½£Z9éPXneErÕ·ún`ì?}CÂñEÈíãoH©[Xí-f ¼fhï85Õ!ñ¸¿A2ø]wú)iªï¨Ëoôf`®\þþ\ÂXÈRè%öçb>×55XçÏhêÊËizXeÐfPÒë;ú*4y,áÔÐ|Ó£Í{%gIìô..òùþáFKP-RðCæß¿Î"ÿ 8F3Qäém{N_§é\s«Èðß´C6 C] ÙüG>B Le¨EE¼¶é©Jÿ ³kóÚ`&wA!tÉ]AZ2ãzñ/ òrÔÜf¶9}IºVa>° QåýU²Çøë(5[huíÓñì.ñÛP4TèRòUl¨¢öÕñ\õí¢x ÙýD![r+ù :íz±R :Û¨!±¦=h¿K/éCc#7bGÊta¤îta8m,ÌÏX5IÆ2T P4bXËþ56LX±F¯`Ác¤"{ÿ ¨»Jê à¿O¶JNZÇîdZèô¥ói³Ù¹z¨·õ¹Êåÿ ãA A@b\¿ðÐÜnÝhloo¡ðbåúÇÿ ¹råÿ ;ÿ Õrÿ ð.\¹ü¿ÿÚ ïo¾úÛ{û?}÷Ã8 ,¡Clþë<{>÷û>ýì/GbJ1RÉ^[Þ¬ç.¢8zE¤¸U(~l3 ¹<yk¬6(þÖÀ°ÎªCõ þòPòE<ô¤nQøNí¦Í% ènjvµH ëÔA)Ïk¡D>r@3¼{üM o fßó ÆsÙþMTÛëì$F²6 1ÛÎ?ûÕæãþçø/¾ûï¼~'}÷ß}÷à@ÿÄ ' !1AQaqð¡Ñá ±ÁñÿÚ ?øD$cða Ò±?czV1èâA¢7¥bE ÐcDÜÀ(_ðC ÄÏ©}ý F ¢ öÚXj=&@VæѵÞXÿ m] b2Úº/Ö×ϵ[AX`¨Ä¶õ?b:ÂY¦vǶeçµGÞIÐ[ s+I¥hÖÌÀð Ð!9®'<ê°à`P@BJ\^ÂÍ =±{;ï^`²í¦÷$eS bÙzûRàÎkó¦`7*KïEÈ;C¬B{Ö'++PÐ6~ QG6¢,1Úä 6CH2ú ¦lÝ{ñ¥!U¾÷¢ ÚV¨"Ûq¤è|ubµþD&Ö§Ü ¨Ãw ¾ðj¼v~*q$.Äõ© × C²4ÉÓ¤QÄ Á{1.!-yú jû¸Ô*4'o?Ø%Ñö¾GxÄ@ñ ø¨1,ò;~¦@ §ÂÅ ó^Т%Õ·R?Nêþàh|óª¡ ®aÀw( àfHÒÙL¡ ¶é³Ä4"N»>qâÚÝ> Ö (^Û/Ôº k9%p ã \CL v¼1Z?M/vöµ íÐ º*ýÍ8²ãÐÔAÁ¡>b,«öîVv«D ¨´ÏEDn#¹?¨/>w3.Ã+ÿ CåTo ¯Ø+¤ ° ]{} 'Ô At æ äßÜ õ BÕÅèhzãXZ µEzBÔówÄÌy ål Æ`ÀTøþðñýÎñI =ĮɩqJuƺ^~icµ"2ùLkp+UÝÞyH64+ÇøÇ(é Æ Ã±Û¥Jæ:8Ô èºvÜkK×ø`¡h4ä}[CY µ åFô¤0aÞ[y¶£d&¥sFë°Ei ³Úâ³®6:ppÎ i +ÁðG ³m sDâÿ 1Xó )ðùq ¶ÂÖö?¶J³¯ AZ¦ü¿µw¼=oæ"+DY¢ÎAk÷AKbt¥_FµW¨CþÙVúAÁÀ`E!Áõ7 E»] Ñ(ÑRú-°Å ÚýéW b@T<ê=º½Ñ8@1J$bëï3ï5îå BE»¤¡äÓû T$l _]?p`L£ l(¨¡%®úºB0ÛP²wdì©0 BÞTòòÔõQ£úR!/¬$ D? q"~`8zÿÄ ( !1AðQaq±ÁÑ ¡áñ0ÿÚ ?T!>BT!>B!B Ý %D¸4Ø¡Aâ%^Ïô;ѪÆJ$´~¯êÓ!:1ø iàFÆ2Q§hºä¹lZh µ Ú§F)i§éðko9ÍÉßþñÜxe©[3zøN²'rQÜc¦QàÙÔØn+ÔÔ1 -LcÏAªwI½1s®E<H4&×nÿ ßATdù%îm¼SÑb¶ÝO.ò c·^£bÄıä2;«:gÙþ qäI¾÷ÜDÑYün9Íç¨ûÖíç7Mø¼÷)h;î%¡/Æ·®üÿ u9¾âzó Pv(Ýkø ®Üè5jË~Onù!og»ÇãöÄ:+G¸¥±ÙÑz^`¥EÌú0%* êo¯oèÕ;sðùAÎ{ a Dú¢ ¬ì¼èH» 4¨éy%F¦0¢ yÎu!ZÝÈèÁ.xl2Ezû íS{íð%5öϯìj´Ï\Ü'¥ª?<þóöCI8ääý Bè¨ N¢\g<ËØX³¥( ¹ìnõ)EMZ0бÑJKA4âO÷óÏдRÀׯÑJRøÒ¥)JR¿[)á|ÿÄ ( !1AQaq0 ¡ð±ÁáñÑÿÚ ?þ4b²,Éù&LÉ ûedr>¿dÉü0ÈdÉþXzü+?dþ9&Gü#É#þ#ðû~õõã!ëð¬æö϶FC'ÆOGáXþRà°ÉäÅ;ÈúÄøÉÿ \ô Ñ .Ö`UÐÙÃ?lV'¿Â漀 zE48wÁ¼ÁàMüÎï 2Ê`¢éK§¿ý¦}q(«|ů²°F%Eêt|ëNǪ Nh °Þ³HH¤ ]·M·4ÝO¼s B*Í<~CqL;Éc³@TXksXÉ&+ñ ¬»3?¥¹ÿ ?& -ÃlÐÝX5¹T6(0Ý\ÀfÚKìï½:xÖ¨}\@..¦ÏüLQ6 ǾOXÆ1óGc÷èãí9haâwUv¯7vÐ@¢¨w¡QDßMþ¬ U²èÐÓ^ã ÒÒP(ª¤&â-lK¾ù÷9X²#³÷#ÀʬÈU/úô¾Ë z¶;Ý¡*Q< Ô v0£c ²ÏLÙ1B#P ¼øâ5" ÊÍ ]ò«{ç2ýÆýF{¦;éM08û¾¿Þ8YDp¡ÐaêÛÃϼp4*,TÙµ7×·=ç* Á!k'1¶Ð6Ø êÐRh0ªIAAaw vyZô_ÛâÁÀ¥ôEÉJ1 n & ©Yj°Ò~ º<îqÀFÆB4Mâ²"gÓ¶ð[n.¬å òwí'yUh¢ò.SÌ°µºï>{(ìë3{@J íNMHª¢A|)r:vqé£Ïu `J¦<AÙ¢ÓZöaY°BQ1E/ïÑZÛÙ¦ÙOî dÍÙZ¢ Ý«È%UÍ¡Ý/ÿ ¬ òéð©_¼âéÕ%@T"ZMôôE_y<¦ÁGl¥~Ë,Æ x MIÌ¿NÀÐhóå/XIR=´xîh*L1ÅÐÝÀKCXD¾fåÂV.\ jÒ¦ç·?¼g+é Fî#kT4¾èô_,\4úi þ×Uá½è§]¡Póç»ë2$¡ DÓ~íµg+È*:UavÖ:Q¤vRí¼ò\·M2-¦êPB¨£A 16õδ+SE¾õ«äÁ¬TØÑwSZ®ùÜ08%OU ®©òå nÖÆûáÁ¯ïM :,Ö¨*Î.Iúÿ ®X1{ åãi @ª°ùo΢XîªãV»2fÕ°X¹ß3vTñ@miºXzW¸3kP( ýz%G ¨¬ÒÓÌ>¬|1Üà¾MBHUk{ÂÙØé U~÷¿ï/Ô$¤iÏûÆ?óLÐD/°kŦØ@Þ}æc.lÆdcZ%{Lðé·ñ?é¶" ] Uv¢Ãæ ô8o¢õ·:»ÀÍ5oêú3n æñ¢ÞD:ßúõLtàÕQ¢M×ozÄ 6¢Nº:Ðr1 x¬¦²i04Щ7ÁóÐiðݺ:swÄÛxT¾bô0 XâhkÞu1sðt#³$-`Jm³Â<HLYz`")b1?`üfÞb}WUÔ<{yUz®^Å (K· Ï<×q5H+ лaw¡uß;= }×ç"tD,Ø ¢t~f'<?1òLLHCÆrSf®å&è Ðv{Â\`"JÙ·Í'¿/Ä Î Û j»~ÿ \5 %#É¿Þ.Dìq j¯ö;òÅK4Wðw9ÎÌ8w'¼9ÒÀíF¨Ö$ãc§JIRC9Ê|#çt #.¦ÿ {±49 iÎþµy ÇnAú¿ýÅ7ø ÓK!, JH·ØH¡Bí M /ÛÜê-æ Ý ¥[n f ¨ ÑtÓºL=:¶|=ýåEóA+ôR¿& Y[³þ} OÀ3\'m£E64çÉ³Ï fëfR ©ûC¿'ªuB1 Ð"¾Ç3 Á6`§2Êb°]lÆ&(Ò M/óÎç d^° ªº=ªü· Ý/ÿ 1b ©¤d÷ëçëð\v âM¬©l¢ I´M>ÑðÙÜ¡6 ÇÓý$b@ééj¶öU§\ää|iÑ¡|ôMB>B 'BW¼Cj¶m@ AVÈ¢ºÑÀgѵscÕei Ö^o ät.¸ W{q:&%ò)O$:ïÓÉZd´'M@Í÷J¢9Þsë*S9%þR³¸çø0Z ¾[|Ë»e²ìWt'cIm<"át½Bªµ¤Å³KYcÐö:ÒÁZ¬$q[ÅÖÑA!ãÆÒ X]ì Õ~ÅÕ ð¼ÓÖ«©&p¢ÄkCµZð e²HvݱE$Äø+î|@ðÿ ÀNÛ@ðÆ>cëlG- ÛÉ,£Å4Rï4¤ÝUCoßhñS zÑ4rtâ \9X}k·øUÔº ¯gX»0hõÿ î@òëór@«àw× H4TTè¢MIµÆÃÅvB&èÀYs@t×È@ýÃËÞR<iŠШTÑ]|¸~%-b@ehKk±4. 5 j»µÕ^YJ @7Ñ¿Êg/?daèîæðDÜè+»[5JÐhPiM?Í$4%¡ ±éIÃp,°¡ÁWöûÍá ¯þq sËmb MÎ-6à¾J%¨®Æ«±íÕ4 oÀEKQ h*PèÚ/B°éÔi¶= CCO ´¤_x« /4 SÃ&Ì¡Ó&,ñÛâÜ¢ÀeìÜ ÂúÅRõ¸¸þó´ NTuD¼ëÎû µFÊ7«A´ÚÇTãÃ&®&+ PjwÆå`<¡ÐnÕ(DË h²t¶® hº%)(ïÂ`Bf£~uÝeþÿ ÁU«q1ñs£wµÍ)-Ã]Ä i¡[4ǾM&ì ã Ü jnÈoÓ°¥ ñ0á±Dìm¬VñD+`Æl)EJh\ èrTKg³]óøÍ1ÚSà§öau i { m1 ¾b¡¹vzÝ\0 °ÓfÕ W©/ %ài@:ÏGXT *]¨u0JtÅù Að Ô Ô@CÜù!U>Õç HøüG %³kö¡öã°Õ JCÛú ©hQÄw â½d@MÕßA 6kÉ° ±(@^£´¿Ùíï=ê`2 X`õ²nWe<Ö¢ªhtìIðJùì9¡B¿ûx Ã[Á#²Ú .&9¶¢Jª ¦[ BU'Ö° θD@TÚ}ª ¼^(YeÈè+}¡¬Lêá! °åLqm°ì§V¢](l | jý-$¸b£Âû }âêK&XM]ø:Æl #xÛµÔãtu$T°´ »!ñ 5 ÂÚÐצºà7´ÖÒ.ÕoÊ¿8Bh¨öÀ?Fx1vÐíø:ãh$JD¡mÖ;~µPkI gµµ<´ ÞE.ç ;g© Шvi õÝÝCMÒ¥¿éÆý#í.° ßäCô/éÉeÖPEØAÐÂ9¨nA)TUúpH´j_6B³H P@@Z@< ÓVV¯íÛ¤ ªø2ÅFı,8`UÏ D ð /q àöÙ¸Z VÄw]· Dè>G×ÖE%Í à |ã j*Â&ÕÐãT °Ó×`ýó¾gj»ä®°[M=êÍÌ ñH<ûÂØb5g@ èM«4S`ªðÁ³è¥PZZÖ¦R¨F]Ç{Ð}G7Q)Bíß ÒoSab~ùé¬8ù$Oû¯÷ÑVÕóùEø¯¼E<"¥MBºÍ$Rªô/`¨^ Ö5ð¨ÓPZñ¸÷bºä©Oø pâ _lôaGô@È¡ÙàZ5Á@$Zе¾oª¡ªí×>»GÅÄÊbcÂR)Vü¬Êä{ óB»R D@ª(64E O³¸`4:I@Jè*å;U"@+7Í 08Noh 6¶M÷úG Fè¬DDI}Be4!¬UÁ¸qdFz*÷JÔZò®v:ëÑp@QÁûtëNè *½° ôL7m[ÍØ=Q®;ÚóXR×1Hko]o¬+RS<9ø"äÐÚM @µ©MV¦¦Æø Ȫ1G}!ãÀnmŨ*¥O±õ 4Â+`ìß ¡È ùY$E-QJsN ®5µÃWË©ô~ Î ³YµÚiòöë8$µáàXY^å¦D"U Q³ÅÍ@úMÉÈÞ´ ÖGèõj¡Fê÷í éÀ! P²þ¶ýõ-üÆtd v<×#GXé !ÐG´v\>X T!Wua lêÈnvtÀÙ?ßØãÓLM>Çö`B:=%±<©;¬pÎÔh¿m¨¿T ñ ¾8¢SE³ Ñÿ çXo"¶§ @ -¥ÓÚ ?Bªpu ¾íiÍÙ1 ÃôGk,5 @ Hé0õ´xÅf é9ÿ {Éh¨ÉDÏ>(î&n t~A{÷¬×Çàeè0¥¬Êl¸ T1 ¦êNvîÞMjyl+¼Ù#ºÌ`±P@úÍ åÚÂx î·¯O§è_ X¥gZ®º»û¦1 Ü6ÍîªÁ`ÆÄÖç; \Tܸ pV Ù\# WÁö¨!IáÒ<Ei̱Á<Ss§ßÇ£Á{Ê+kÄ4vÖ;(êØiUgmêTUÙÍMox qÏ+³^VF÷y @ § á,»H;éaßÛW.I3a$¿AwKXOÅ íFìØ _÷Ð|XQ^³mRÀ@PRrg#ÐcànÁãÂjÔ-odP ÑàéZEAH_éý,Ð é6Ci^G,ªÆRCr¼tkTqËó2ÊÓå ú X¢å t)¤)Ùc¤uÜòµU÷«Ì £PºÑlçbë,± ¡c Ýð{À |Ò yÀZ%ÜS"A*{×lØ@ÛáÞ;õàw´W»Êþ. Q(DÄ;¶×¹ºa9ZðB¦Â#£V HÂ`øSÈìX¡Jp««Zp'¾º0=â m¢î íÕ-I Ü×9ïíÏ 7 ëç \¸8$è% öï^z ÜïS&Ë¥znA» 7:G³ YÈÐ ºV»Tú ÔJ-Z8YúÝkÊ-<´4xçëÏr£Õ7 JóÂo ²`j0*¿[õ|ñÿ ó U¯Î#ÞSÞ ÂbXF:Ü]9ECuõuÜÕ=ñfÇÆϺ c¡%ã[ÆÙK©¨0ôA$Ñ'ë 3p Tíò.·IÊbnñÓã$!Õ½CK¨Ôde`ÚzÌBi4Fíßµæ\®\®8ë 5íYú |®ð h¯´NõøÉ";; tmxjùøæ @lGM¾1âûÈϧà&!*8¬O´Q×E 8SíNÑ}[/5xɪó×&85)HÇOiòo4b$nÎëYµC4Wéòw~ DW¸áWò3Ö:E10Uã§|Gab Py´aÞöc Ô? 5<QMÓ ;SOïí< ò±×oUì÷OfÊd [½0ç1ª´ú1Õ]þ)Ê{Êåq~r?ÈS °£ Q )8`$øÖ7ûË/æ¸8å<<pÜ¥8u0RînÎI Ýæ¢á@<âî AOXUËþJeÊåråråË+ü)÷ø®\\§¿ÁX·üéË+üª~üëï+ïü®S.Wùiï#>YY_Íråÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14228 |
| Response Body - size: 14,228 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ùóN÷¨Ãp` h5MM À ÀO ðÐ0Ð3á `C ÌÐy&£ ¦è(À(À(À) ðÔÒy0Ðxn¸áJ<üÅQ\ MM `jxnµÚXà½(*+b:ÇB°Ý Ýê~|«<N5s:§È:ÇUr é+òó´°âóÕ?iÎk½ ëÓ²cÛLñN8FÚÖsã\®=b³7ÉJú »¥ÕÊòÏçéÞ âì9 ÐqXu!ID[czιer6´qc=È´:7¿#Ùѹ*%Asíà§6b*çW8u½¼© 1:çºr7CICZUÒwN½eo"Ì·.Y`ÉÛ ù%×Ëï;ZÐÕÊÕ¬ªg ó³hë49¯×ºi_G¯£ëJÍ¥Q«MzÇ.ÎH÷¤©]üÍÔ1)*ÙAÓO¾7µâäç|§Ô|Õó6{Ü<ÝÍñÅÚ=)*Y¯:Yɪ¶Çò¾GWçö~+G¿YÒ5zæyÐ^T·×F ¼_ÂÉÍù¿øµçêôùkÏRRtÏèÝæò®øg&ÔÙµ@çå%°Ëfûϼ¥zm~G]nJ¾aC+ñ4¥Øm«éôìJÅåôf*¶ (ç DW¡ÜWwIͽòÊÈ%a1×LI«vwX]ÊÎC£ xj$ç¶å«L±ubÍÒÅo:ºcÊF¥¼¤&Bz (ßNf{yM*éë+ήYÍaE}²}ÃÃÐ ºµ_3úë$hlR;é~^bçÖttstvKÉñjª*Ãsjj¿¯Ë<RxtCcQ:gç|ò¯ ¤¯%p@ÈutÀ5\lüijUSÕEÅ6Ì`²=;ÌK ¶JJç8Xê¤té¦ÂèS£åë,M³}iÍÚO2 0z``=ÌLÓé´À4À7 Ea@a@qFM³î ÜP ð Ì ) ÿ ÿÄ * ! "120#@BA`pÿÚ ÿ Í+ù8<BþJuZü¿V T¯0µ+d-ÈX`) ^uBã\Q) nµà ÙÉj¨WP#xã©¥Åö ãì °<{e#¾æFc;Èç[v+ÝÂhqo ª«e ÓS.CÔ>±þþèáj'U:N®Ç?SábÑ"Gdö²HɲäÎF")¨¿L½í¨Hâ,ë½Àn}ß}¶ ËO¯=¾ãP¸ýËUê]¯ÀDvà @¥N#âGî` °Ù®5¦7榢®Ú²äemÂWµÚÑäÆûWEW°ÀñÉê ÿ .q¬®ü!*¤JÐ%Xú·´ã¢ ¬S¤ öQì8¼+ ¶â5*(Ý´`Ü®è9 îÂPJº"@Àv»/)Öõ N£.Cøî«æ¶ nû.TAò_Èul2cêr£`Ëóbcìa=Áqp]u¹þ ©Ê_¢ê~tb# ÞÙj!b¿ÀÙ:vVFüN#1öjºî ûúÊ~CEÍedC ¥ªWE7=Î?Ëb.[ãTàé¾Eäj0¯ _U¸ ÜáÊ9( ëu°ÛV!Dn\U cÑÖõä¢=hû j] mòE¦cz¢Àp¡@ E{,Æÿ "ÜK¾Eå`Î_Ô$v¸[|µrü]®êþ5ÈáC4&z[µÎfï¸Ö\±ØÜ'# =ÄQ v±ÀlØDÔøÚ¸þåéÎÉäÐʺ'°ûâ ÷ ©R£¥{K2AìµêGp U/²þ· svâüQÇÝHnËí2®QÖ0̸çÈÃbøïúN« K?Ø_P!ñ¸}Â{8fÆÅaxíá÷ NW ´ 1Û5ø¤_î%LmÆrÓj îvZ¼WéÇdútÎPd3W@yÜcÉ/W9 0f.à 9K^Dù?r=§û¡41G±c\¿ÅûÐþ g)v j\¿ûßÿÄ / !1"A Qa#Bqð02¡ÿÚ ?¿u«WíµjÕ«÷Zµ~ËVZµjÕ«VZ´\Áºl¡ÂÂZ´\ÖßÙC_ÊõQVíZµ6@ Ç<´7ÏótÜ°åê¨Ó ûQd Jy ÷ÚÈ}ð¢Ê2>5ïb*ÇËÖ7Z\Ó¥ÌhÎõ3Úý~·B|®¤±¹£ý¨r(°@M1{¼)È#Kê!7Wu64¼øþ}V©"qul¥ÆÑÝ#Xß×Ô¤¦Ì ¹äð£ÆgW°~èÀÐ8Y )ËOMü©5´®°s÷;'æýEG5I<©atG\i³ º5(§Ú.L À3´ìÐQËû§Üëg*Ièß]mj Èe³ÂüE¤B9Ñ *W2A²cÁ^´ZĸìW®Ðâý'æ´rÊcü©¶îb$r£ÊÝbËmíÙGñæHç ©Ï*~ ·Pkáe61 ßá`]nf¡ªfÄçè¡d] ¾ wÙcùåH<©ºcûJÙÒî[XÖ#u©DÖiíR Áºö´) ³J,KÝC,ÒÔÜ4näì6ù*H£lÑ59zMÖ xMÄ{çVÿ /(á°sº t°n¥É Tx= x³äìiO/SeYÒÎTXÚSX Ä&C[y 9Ø%¦#(!OÖþê8L§¨õ3;Ú@kÒ|ªÐ/õ Í´÷ ¦È.:#å3 @û¨¢ê¨¢í×ôåFD/Óà«T8Í-*`è$j*);£}¹ n»V> hYQ<&ÉîYÒle æî¿2Rßú Æ6j²W4©GK½ »§çt|© 4Î1ªTm;¥6&ÄÂ¥H²Ô!×÷Qc@ð¤iA©R©¿ÑºO®ÝÂôÎsµ<¦ÄDz*Uó¥J*T©iT©R¯xT«úóÿÄ $ !1A QPa"ÿÚ ?ýUWùQ³ÁEp²3í} è¢c-*Þ(¡éþÉÉÚÑ|] ú2(¡ª:èlLNÊ1 N:2Ó$ElzÑÇ´bCb%C0© «,?Éé\ýÒFÄ*òO SÌxli ©ÉBÑé%/p´;±phÆôB mfBt&w¶{JÆü$YÙÇì#Oe£%ÅdV»,LËCØÐeC߲űi³h²ÈðSmbÇÞ¸²Ç´-öEJÚ} oáfEÍÊQ þ§ÿÄ 6 !1A "Qaq02¡B±ÁÑáðb#@R`pñÿÚ ?ÿ ؤþ^÷+ }Ô½üÕá²²LàªÜg#1îLp÷¢¨ Ý.Ôd À*÷¦J³kâ$ ¤G ªö|µW8CÙÄi 'Ôê¡¡P0¾ájcD6nwS¬ñÍÕ(tÝi¼f8±åImà¡Òµ`i!®PuäéP¨;²Çf6dµß¿öT-øG©íò ÝDdÆU¶%Ð:X o~Ïõâk¬Ð¸«" h[}¥ F §1'ÐÉ.YÑYu}wqk}× úöF⨡ 7¿ºbQ÷Äc~CC{aNò¯×wF;©Eĺ0«6 ¦ñ27exV~ÑÍ »£0 ê'wV$ ºa ÁЩ@hUºµ*+$£S<ÀE.®N/;³òÞ8u¹S"¹ÝYÜKt$,FêXæ ºÌèOci¢ú}lh¼¯^ë¿9Í"QÑN0L ÕªµÙe_$ ¨'^ è6ã=&Áì @wâòÅ«¿.ß}>K+¦f>,xdOä²¾|ÕºLöÊ;7üQmÇmM§ÓõNë#EÂÖôB1Ù|.twD\M!=¢í'IRèÕ_<-¶öeî=ÝD;ººX(ÈÕï¶p« ¨jwN«£¦4Óè2Fª6} aaoÌ"\óüE»gïâFe&'Ç)о"ÏÏi³sL0~H3dû ê§Ã¬yAÂ">ë_E$åïr´AN¡þ+ýÆbê .$ßáqÊl¦æ\ªôVPêE Dá §ê¤m ´ád@ Åí84?%®´£ °È=T}UméiÛB ZëÙ\,Sv]q~ª Y^` ×HMcõ\@½ÜÕ ú®<X(¹ÏëáÃ'ÍJ¾YÁÒ4ZÉ6F+Oo Ey)Ìiù \O¦[¥ÿ ú;U®V~¡tºá\$v_¢z z@4Ï_²0>9³»²ü$ùV@]B) ~ÈÍÍ '¿T¤áqXnÃg§M 0z³góC¦5R pÂ5ß>P1 Ý5ïÉ0=ïªiu VÞÙË÷ª¹¿Ë²Ð ʳ~¨Hú# 4Ö0@ ýZÈ! ªÅÖJ.3Õ PV« < ÝZÒ̯åz##*¸FëÂ*ÓÌód æ wdÎT,Ȫ_åÍ"ûÅ£éÞ#¾àayWÈfȸ]C;ó?¢µ#Uä'5ÂCIð´ÞâFï²t]¼ªådÙê«|» [¸x´Ç³hÝÀfàyC"+%qí ÂÙBh(1w* v9ü·¸ÉÐwO`lEü¿°«â@pî¸rP{H{¿Âhu,ÇHÝEJÙµñ/1Ûûü©dp_² åµä®W_4@ÿ o:¡ÕõNvª2±Ë êFW+fó<Lù©Ä(n9p*÷8[?i'ÌJ/¢qÚ7h')£Ã«ðêµ×ÜdOw}á:Èâ ÓjU¢oÓÜD8²x9n«ÑACöWÿ Ô ÷ ÉP1ÿ ÿÄ * !1AQaqð¡±Ñ Á0áñP@ÿÚ ?!ÿ Jÿ Ë©R¿ójWþ]J*Wñ©_Æ¥Jü*T¯ðT¨°ÈÊÿ \âë½3[u¨À<2¥JúWòÑÍQþ2Iïqt¥\©n¾*T¨Ò-æ2Ýn@E !Ü}~ÐpèÅU¯:(±Í1¤¯âiwÝâ·UèmjúØ4ÿ UãåUhôÈàhN¬`û ¤b¥ ¨Æk ýDÝÙk× >©z#eÖ ¶Ñ®Lÿ ¦8£JéÇ_^Î â8{{þ¥$ª³¦"¨ÒrT¯àdËA{Ä´ãí0§ R© l¾3K¸]yMú|¹ÚMÏÞU í¥°7\iÒ¡¯Ü©R¾·è½Ä -:~}⣰ÂXò«Q18NõæjV½²] !ÇÎÜjdPÞu]\Ï8öAtk[+Ì¡©R¡LÐqurÃÉÓè .ªþu%9ÃZØY¬g1YÔ«þ]~Ù¹mîÿ ¯l0 ðatýµÐmªéį LµÄb¦l\Q= -Ûbç xÜ XÇlÅÄ- ~zÎÓ_Äy*üEÐ]ï¢}@ØÕ.ëþÿ ©) k¸?E#élü;DÎñ~¼¼Ü`9§ þ¥Ø!ÕûÚN½5¾h i²µí<'T@óÓ S úå(¤g´s§Ü®Û=Ò!gN¥<ú½±ÁYqÅCkAà'^%@5t^¿oêdÊó%è¬ ØJí Pê×Ypa [[ÃQ+T¹ÅâÏù ÜßIP#Kv¼wñÇ=åLcCUÞPâþçá"ö+¨,¸1CL¼øv1ÚTåߧ¼`f`P·dNeÑ*6g¿F/0É®eµuséùûtERÐ6;õûcÚ òTXÈù°)ÖfëÒ¥âë ¶+äý}D!Õ*& ⣦X<>lí¹Bp¥6Ðï¯6ú%P)mà7ÕÜ4'\tF£´²¬Ë¥;Kà1õàB F[ Óì¦Y%!Y~ó7_luíä`Ug'>Ó^WgîþÑ¢ÿ æ(gÐ!±N· zíÏbvýLJ@Í_}@ÙTlEìTjdn J5=u/4x(C}>°T«ikeà}}%tâ]{MK{J() bI6 k¿Æ"gÐóý0§4éÀuþã|-*¯Üºùä,Ö£5«iJ#7Wn}æZô4ÊåR¬¹ºûMF¥ik²Îæ2u2f £\í¨ÄÎ5gnÿ Ü AêJ¶K`v׸ÁKµ¾9ô;þG B©Tx h'Ëé ¨ÓZÌ ©ÂáÅu õéħ»©W^OF¢ áÓ JÆ0e ¦^MGªëÞYß\T~o.E¹ ¯(¬ ?®?¹vÔ8»^·/4_-ã}³~зºÊMôcêóþÍB¦Îò)Ì©ãb´*è }içæ%ìi ª9âPb.]g½å °2'V¶(þ¢[®ÐhqÀínÈVW6¸¬ÝÆ[¼Þ𰤻 B/X, ù ±OäùQ@oW¶%âÔsùj$l'àa?·Y&|G,-õ{1tÕauÇ<ÍQT»ÓßSlMq{Ù̵`Áiw¶Ìçá.zÕ³goí_Q^ïâ×@»´8WLÕKºÞsInï-ÂõVìu2â ª mÛX ×:ÛÉÿ %Ìa.4\0GxÄ¡/æ'%L _ŵxjÏÉò¥Vó¬ ¸¨à¯aI1ýÄlvÎíªOÑ`Æo:Ë. Ê ÃXver¶Åñ17G :üâ°5~ -Æûs5£±¡8m=ëïCnºµ3ÄÖ®|Kn`BÑn8 2¢Ú/båHÑWyô={ARòjvÂF¨£GGYÞîßJ0 YV®îzvçÕ_C®ÓÃõ. ¡ ³°Ëåoç¼%àñÛ÷ T;Jk3HÅÏ ´|ÅNùc"{?D$]ȺVN°áiA} n{Wö[ëÞXK_¾ãgÐ;{¹+æ '¬ÒÞk2/\ 7->Ç1e®V÷Zéjê¯akãYîË>ah ôV /XÙY- W|<ôªÕTâá×¼=g>´±³u²ÔníçþÊ2£W{µj±fú~³0.\JT~ã××Æ%JÁº% ¯ ¢ðë¼qûld=1ªõéSÛð¾Ëvz}¦kG¨~¹a`áÈb°t WCj qçpC¡«ôçuûP=ÃY OÌAl±´(S^´ñ_:Ô°*¸"¢«Z kïU\óCuN °Æ 44ö<Ek¹] t[w >0SL{·ÐÆà¿!Ù|óFÁ×ÂZº½\öéë1HwÝ ÃÝ¿äçTýa©@ÖcR)®ÚßYkzªyû@+Ch 7îÎBJ¿yA_Ü®Æ8 cµwNfÕ¯¬¼¸D¥ès (C$߶Ù)GÒ³-(R9yélr¿ÌÇ1Í[ â2³A2Û´[n ½?pfà9u*xÖfJ7Ý*¿«WR^·õÍHUbúêh «7Û8×?@ªMd²ÊéÆQ6äý0vV&Q9þÔº¢ÆAÁëâ¹íSLÖk9+Æ\Ëm óÇ51dgn¥Ê.®ÔÔ# 쫯=4Ã/:õ~òý!l¦ï¦®2 Õï>¾Ó2ZÕ[;T¸3Ùº[ð6 #Ìáª4¯É¬Æo¦æ%KCP". dÑå¢X·â#f ¶ nìëÛo·Ð Ý7·-^"Ñ4ºQ¨©«FºJ î·ø ĹrÖÞ§Dðcn½£Z9éPXneErÕ·ún`ì?}CÂñEÈíãoH©[Xí-f ¼fhï85Õ!ñ¸¿A2ø]wú)iªï¨Ëoôf`®\þþ\ÂXÈRè%öçb>×55XçÏhêÊËizXeÐfPÒë;ú*4y,áÔÐ|Ó£Í{%gIìô..òùþáFKP-RðCæß¿Î"ÿ 8F3Qäém{N_§é\s«Èðß´C6 C] ÙüG>B Le¨EE¼¶é©Jÿ ³kóÚ`&wA!tÉ]AZ2ãzñ/ òrÔÜf¶9}IºVa>° QåýU²Çøë(5[huíÓñì.ñÛP4TèRòUl¨¢öÕñ\õí¢x ÙýD![r+ù :íz±R :Û¨!±¦=h¿K/éCc#7bGÊta¤îta8m,ÌÏX5IÆ2T P4bXËþ56LX±F¯`Ác¤"{ÿ ¨»Jê à¿O¶JNZÇîdZèô¥ói³Ù¹z¨·õ¹Êåÿ ãA A@b\¿ðÐÜnÝhloo¡ðbåúÇÿ ¹råÿ ;ÿ Õrÿ ð.\¹ü¿ÿÚ ïo¾úÛ{û?}÷Ã8 ,¡Clþë<{>÷û>ýì/GbJ1RÉ^[Þ¬ç.¢8zE¤¸U(~l3 ¹<yk¬6(þÖÀ°ÎªCõ þòPòE<ô¤nQøNí¦Í% ènjvµH ëÔA)Ïk¡D>r@3¼{üM o fßó ÆsÙþMTÛëì$F²6 1ÛÎ?ûÕæãþçø/¾ûï¼~'}÷ß}÷à@ÿÄ ' !1AQaqð¡Ñá ±ÁñÿÚ ?øD$cða Ò±?czV1èâA¢7¥bE ÐcDÜÀ(_ðC ÄÏ©}ý F ¢ öÚXj=&@VæѵÞXÿ m] b2Úº/Ö×ϵ[AX`¨Ä¶õ?b:ÂY¦vǶeçµGÞIÐ[ s+I¥hÖÌÀð Ð!9®'<ê°à`P@BJ\^ÂÍ =±{;ï^`²í¦÷$eS bÙzûRàÎkó¦`7*KïEÈ;C¬B{Ö'++PÐ6~ QG6¢,1Úä 6CH2ú ¦lÝ{ñ¥!U¾÷¢ ÚV¨"Ûq¤è|ubµþD&Ö§Ü ¨Ãw ¾ðj¼v~*q$.Äõ© × C²4ÉÓ¤QÄ Á{1.!-yú jû¸Ô*4'o?Ø%Ñö¾GxÄ@ñ ø¨1,ò;~¦@ §ÂÅ ó^Т%Õ·R?Nêþàh|óª¡ ®aÀw( àfHÒÙL¡ ¶é³Ä4"N»>qâÚÝ> Ö (^Û/Ôº k9%p ã \CL v¼1Z?M/vöµ íÐ º*ýÍ8²ãÐÔAÁ¡>b,«öîVv«D ¨´ÏEDn#¹?¨/>w3.Ã+ÿ CåTo ¯Ø+¤ ° ]{} 'Ô At æ äßÜ õ BÕÅèhzãXZ µEzBÔówÄÌy ål Æ`ÀTøþðñýÎñI =ĮɩqJuƺ^~icµ"2ùLkp+UÝÞyH64+ÇøÇ(é Æ Ã±Û¥Jæ:8Ô èºvÜkK×ø`¡h4ä}[CY µ åFô¤0aÞ[y¶£d&¥sFë°Ei ³Úâ³®6:ppÎ i +ÁðG ³m sDâÿ 1Xó )ðùq ¶ÂÖö?¶J³¯ AZ¦ü¿µw¼=oæ"+DY¢ÎAk÷AKbt¥_FµW¨CþÙVúAÁÀ`E!Áõ7 E»] Ñ(ÑRú-°Å ÚýéW b@T<ê=º½Ñ8@1J$bëï3ï5îå BE»¤¡äÓû T$l _]?p`L£ l(¨¡%®úºB0ÛP²wdì©0 BÞTòòÔõQ£úR!/¬$ D? q"~`8zÿÄ ( !1AðQaq±ÁÑ ¡áñ0ÿÚ ?T!>BT!>B!B Ý %D¸4Ø¡Aâ%^Ïô;ѪÆJ$´~¯êÓ!:1ø iàFÆ2Q§hºä¹lZh µ Ú§F)i§éðko9ÍÉßþñÜxe©[3zøN²'rQÜc¦QàÙÔØn+ÔÔ1 -LcÏAªwI½1s®E<H4&×nÿ ßATdù%îm¼SÑb¶ÝO.ò c·^£bÄıä2;«:gÙþ qäI¾÷ÜDÑYün9Íç¨ûÖíç7Mø¼÷)h;î%¡/Æ·®üÿ u9¾âzó Pv(Ýkø ®Üè5jË~Onù!og»ÇãöÄ:+G¸¥±ÙÑz^`¥EÌú0%* êo¯oèÕ;sðùAÎ{ a Dú¢ ¬ì¼èH» 4¨éy%F¦0¢ yÎu!ZÝÈèÁ.xl2Ezû íS{íð%5öϯìj´Ï\Ü'¥ª?<þóöCI8ääý Bè¨ N¢\g<ËØX³¥( ¹ìnõ)EMZ0бÑJKA4âO÷óÏдRÀׯÑJRøÒ¥)JR¿[)á|ÿÄ ( !1AQaq0 ¡ð±ÁáñÑÿÚ ?þ4b²,Éù&LÉ ûedr>¿dÉü0ÈdÉþXzü+?dþ9&Gü#É#þ#ðû~õõã!ëð¬æö϶FC'ÆOGáXþRà°ÉäÅ;ÈúÄøÉÿ \ô Ñ .Ö`UÐÙÃ?lV'¿Â漀 zE48wÁ¼ÁàMüÎï 2Ê`¢éK§¿ý¦}q(«|ů²°F%Eêt|ëNǪ Nh °Þ³HH¤ ]·M·4ÝO¼s B*Í<~CqL;Éc³@TXksXÉ&+ñ ¬»3?¥¹ÿ ?& -ÃlÐÝX5¹T6(0Ý\ÀfÚKìï½:xÖ¨}\@..¦ÏüLQ6 ǾOXÆ1óGc÷èãí9haâwUv¯7vÐ@¢¨w¡QDßMþ¬ U²èÐÓ^ã ÒÒP(ª¤&â-lK¾ù÷9X²#³÷#ÀʬÈU/úô¾Ë z¶;Ý¡*Q< Ô v0£c ²ÏLÙ1B#P ¼øâ5" ÊÍ ]ò«{ç2ýÆýF{¦;éM08û¾¿Þ8YDp¡ÐaêÛÃϼp4*,TÙµ7×·=ç* Á!k'1¶Ð6Ø êÐRh0ªIAAaw vyZô_ÛâÁÀ¥ôEÉJ1 n & ©Yj°Ò~ º<îqÀFÆB4Mâ²"gÓ¶ð[n.¬å òwí'yUh¢ò.SÌ°µºï>{(ìë3{@J íNMHª¢A|)r:vqé£Ïu `J¦<AÙ¢ÓZöaY°BQ1E/ïÑZÛÙ¦ÙOî dÍÙZ¢ Ý«È%UÍ¡Ý/ÿ ¬ òéð©_¼âéÕ%@T"ZMôôE_y<¦ÁGl¥~Ë,Æ x MIÌ¿NÀÐhóå/XIR=´xîh*L1ÅÐÝÀKCXD¾fåÂV.\ jÒ¦ç·?¼g+é Fî#kT4¾èô_,\4úi þ×Uá½è§]¡Póç»ë2$¡ DÓ~íµg+È*:UavÖ:Q¤vRí¼ò\·M2-¦êPB¨£A 16õδ+SE¾õ«äÁ¬TØÑwSZ®ùÜ08%OU ®©òå nÖÆûáÁ¯ïM :,Ö¨*Î.Iúÿ ®X1{ åãi @ª°ùo΢XîªãV»2fÕ°X¹ß3vTñ@miºXzW¸3kP( ýz%G ¨¬ÒÓÌ>¬|1Üà¾MBHUk{ÂÙØé U~÷¿ï/Ô$¤iÏûÆ?óLÐD/°kŦØ@Þ}æc.lÆdcZ%{Lðé·ñ?é¶" ] Uv¢Ãæ ô8o¢õ·:»ÀÍ5oêú3n æñ¢ÞD:ßúõLtàÕQ¢M×ozÄ 6¢Nº:Ðr1 x¬¦²i04Щ7ÁóÐiðݺ:swÄÛxT¾bô0 XâhkÞu1sðt#³$-`Jm³Â<HLYz`")b1?`üfÞb}WUÔ<{yUz®^Å (K· Ï<×q5H+ лaw¡uß;= }×ç"tD,Ø ¢t~f'<?1òLLHCÆrSf®å&è Ðv{Â\`"JÙ·Í'¿/Ä Î Û j»~ÿ \5 %#É¿Þ.Dìq j¯ö;òÅK4Wðw9ÎÌ8w'¼9ÒÀíF¨Ö$ãc§JIRC9Ê|#çt #.¦ÿ {±49 iÎþµy ÇnAú¿ýÅ7ø ÓK!, JH·ØH¡Bí M /ÛÜê-æ Ý ¥[n f ¨ ÑtÓºL=:¶|=ýåEóA+ôR¿& Y[³þ} OÀ3\'m£E64çÉ³Ï fëfR ©ûC¿'ªuB1 Ð"¾Ç3 Á6`§2Êb°]lÆ&(Ò M/óÎç d^° ªº=ªü· Ý/ÿ 1b ©¤d÷ëçëð\v âM¬©l¢ I´M>ÑðÙÜ¡6 ÇÓý$b@ééj¶öU§\ää|iÑ¡|ôMB>B 'BW¼Cj¶m@ AVÈ¢ºÑÀgѵscÕei Ö^o ät.¸ W{q:&%ò)O$:ïÓÉZd´'M@Í÷J¢9Þsë*S9%þR³¸çø0Z ¾[|Ë»e²ìWt'cIm<"át½Bªµ¤Å³KYcÐö:ÒÁZ¬$q[ÅÖÑA!ãÆÒ X]ì Õ~ÅÕ ð¼ÓÖ«©&p¢ÄkCµZð e²HvݱE$Äø+î|@ðÿ ÀNÛ@ðÆ>cëlG- ÛÉ,£Å4Rï4¤ÝUCoßhñS zÑ4rtâ \9X}k·øUÔº ¯gX»0hõÿ î@òëór@«àw× H4TTè¢MIµÆÃÅvB&èÀYs@t×È@ýÃËÞR<iŠШTÑ]|¸~%-b@ehKk±4. 5 j»µÕ^YJ @7Ñ¿Êg/?daèîæðDÜè+»[5JÐhPiM?Í$4%¡ ±éIÃp,°¡ÁWöûÍá ¯þq sËmb MÎ-6à¾J%¨®Æ«±íÕ4 oÀEKQ h*PèÚ/B°éÔi¶= CCO ´¤_x« /4 SÃ&Ì¡Ó&,ñÛâÜ¢ÀeìÜ ÂúÅRõ¸¸þó´ NTuD¼ëÎû µFÊ7«A´ÚÇTãÃ&®&+ PjwÆå`<¡ÐnÕ(DË h²t¶® hº%)(ïÂ`Bf£~uÝeþÿ ÁU«q1ñs£wµÍ)-Ã]Ä i¡[4ǾM&ì ã Ü jnÈoÓ°¥ ñ0á±Dìm¬VñD+`Æl)EJh\ èrTKg³]óøÍ1ÚSà§öau i { m1 ¾b¡¹vzÝ\0 °ÓfÕ W©/ %ài@:ÏGXT *]¨u0JtÅù Að Ô Ô@CÜù!U>Õç HøüG %³kö¡öã°Õ JCÛú ©hQÄw â½d@MÕßA 6kÉ° ±(@^£´¿Ùíï=ê`2 X`õ²nWe<Ö¢ªhtìIðJùì9¡B¿ûx Ã[Á#²Ú .&9¶¢Jª ¦[ BU'Ö° θD@TÚ}ª ¼^(YeÈè+}¡¬Lêá! °åLqm°ì§V¢](l | jý-$¸b£Âû }âêK&XM]ø:Æl #xÛµÔãtu$T°´ »!ñ 5 ÂÚÐצºà7´ÖÒ.ÕoÊ¿8Bh¨öÀ?Fx1vÐíø:ãh$JD¡mÖ;~µPkI gµµ<´ ÞE.ç ;g© Шvi õÝÝCMÒ¥¿éÆý#í.° ßäCô/éÉeÖPEØAÐÂ9¨nA)TUúpH´j_6B³H P@@Z@< ÓVV¯íÛ¤ ªø2ÅFı,8`UÏ D ð /q àöÙ¸Z VÄw]· Dè>G×ÖE%Í à |ã j*Â&ÕÐãT °Ó×`ýó¾gj»ä®°[M=êÍÌ ñH<ûÂØb5g@ èM«4S`ªðÁ³è¥PZZÖ¦R¨F]Ç{Ð}G7Q)Bíß ÒoSab~ùé¬8ù$Oû¯÷ÑVÕóùEø¯¼E<"¥MBºÍ$Rªô/`¨^ Ö5ð¨ÓPZñ¸÷bºä©Oø pâ _lôaGô@È¡ÙàZ5Á@$Zе¾oª¡ªí×>»GÅÄÊbcÂR)Vü¬Êä{ óB»R D@ª(64E O³¸`4:I@Jè*å;U"@+7Í 08Noh 6¶M÷úG Fè¬DDI}Be4!¬UÁ¸qdFz*÷JÔZò®v:ëÑp@QÁûtëNè *½° ôL7m[ÍØ=Q®;ÚóXR×1Hko]o¬+RS<9ø"äÐÚM @µ©MV¦¦Æø Ȫ1G}!ãÀnmŨ*¥O±õ 4Â+`ìß ¡È ùY$E-QJsN ®5µÃWË©ô~ Î ³YµÚiòöë8$µáàXY^å¦D"U Q³ÅÍ@úMÉÈÞ´ ÖGèõj¡Fê÷í éÀ! P²þ¶ýõ-üÆtd v<×#GXé !ÐG´v\>X T!Wua lêÈnvtÀÙ?ßØãÓLM>Çö`B:=%±<©;¬pÎÔh¿m¨¿T ñ ¾8¢SE³ Ñÿ çXo"¶§ @ -¥ÓÚ ?Bªpu ¾íiÍÙ1 ÃôGk,5 @ Hé0õ´xÅf é9ÿ {Éh¨ÉDÏ>(î&n t~A{÷¬×Çàeè0¥¬Êl¸ T1 ¦êNvîÞMjyl+¼Ù#ºÌ`±P@úÍ åÚÂx î·¯O§è_ X¥gZ®º»û¦1 Ü6ÍîªÁ`ÆÄÖç; \Tܸ pV Ù\# WÁö¨!IáÒ<Ei̱Á<Ss§ßÇ£Á{Ê+kÄ4vÖ;(êØiUgmêTUÙÍMox qÏ+³^VF÷y @ § á,»H;éaßÛW.I3a$¿AwKXOÅ íFìØ _÷Ð|XQ^³mRÀ@PRrg#ÐcànÁãÂjÔ-odP ÑàéZEAH_éý,Ð é6Ci^G,ªÆRCr¼tkTqËó2ÊÓå ú X¢å t)¤)Ùc¤uÜòµU÷«Ì £PºÑlçbë,± ¡c Ýð{À |Ò yÀZ%ÜS"A*{×lØ@ÛáÞ;õàw´W»Êþ. Q(DÄ;¶×¹ºa9ZðB¦Â#£V HÂ`øSÈìX¡Jp««Zp'¾º0=â m¢î íÕ-I Ü×9ïíÏ 7 ëç \¸8$è% öï^z ÜïS&Ë¥znA» 7:G³ YÈÐ ºV»Tú ÔJ-Z8YúÝkÊ-<´4xçëÏr£Õ7 JóÂo ²`j0*¿[õ|ñÿ ó U¯Î#ÞSÞ ÂbXF:Ü]9ECuõuÜÕ=ñfÇÆϺ c¡%ã[ÆÙK©¨0ôA$Ñ'ë 3p Tíò.·IÊbnñÓã$!Õ½CK¨Ôde`ÚzÌBi4Fíßµæ\®\®8ë 5íYú |®ð h¯´NõøÉ";; tmxjùøæ @lGM¾1âûÈϧà&!*8¬O´Q×E 8SíNÑ}[/5xɪó×&85)HÇOiòo4b$nÎëYµC4Wéòw~ DW¸áWò3Ö:E10Uã§|Gab Py´aÞöc Ô? 5<QMÓ ;SOïí< ò±×oUì÷OfÊd [½0ç1ª´ú1Õ]þ)Ê{Êåq~r?ÈS °£ Q )8`$øÖ7ûË/æ¸8å<<pÜ¥8u0RînÎI Ýæ¢á@<âî AOXUËþJeÊåråråË+ü)÷ø®\\§¿ÁX·üéË+üª~üëï+ïü®S.Wùiï#>YY_Íråÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 11465 |
| Response Body - size: 11,465 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ å ¬×5æê{¬N=yT_S$ ¢Õ+kËô¨¼\±ÒnriËýÛfë fy»[._&º~vÇõåÉY,o¯Ì îËççÅØün3Lí¸KÇ/÷¬ÂÞ'XŸ{ XÛ"Jjo ±xÜÕ£h½ûÜ¡Ý ùs:ǼÛtÌ^ó6ÇͳåÒý¹~ñÓ-F··o%T K¯Ú#ù:ÔVÝI,dcYGúYï¯HôÜ¡"õ ê;G Êùz÷t½ËÁÖ¼DßJ¥@ßkªÑkÛ~g1®JÆé9 £IÊ!MMèréNÈ>Ò=ùnÁÞzçZ×z%Î;ðKïò Lì<J%û¶Ï®òÛ¸JÕ6_\ØþãynæOk·åÑoùjé´ûMáç¾òͶäì]«õcmä-MîS{ÜãAä_Kq{-@{x Wná]_ÃèÎæuɼj%ÃÉ?ÌNWª°,e±LÏlÌ£ËåZ(ÇT-]§È³zý+MØ325 OϺ¯õØvë¥^X ²ëUÒzóζo¯=ÇkõÆé7¦åä>DÃÉbrÖâȪ«W|© l;Úo±dVµù«Åÿ =e8r¥tÚ¾=Ö*Ú77LÒa Üyï¹[# +J¶]iYë7Ïxý;6ÇÍz>ÕoÞD= F¹{ãêEé¶zC*åîá¦Ö²0y&ËÕ«5®Xj Ô©=þP û_è¼mYO x}Y{/cl&L$B¯ûÝ]vÞvòcÎ̶Ií5æ IZkÚ«Z÷y|µK³ =ª®íoÂìÍMקg98À§_Æâ½nmþö»îVÂa/Åô1°êÈu+Üâ_&ñw¬öä Å7P÷)é0y> ²zu=" |ïÅU) fóç=ñ:ÙBð ÿÄ + !"@#01 3$2PAÿÚ ø:8DºW¸Â¿âZéÃ+J ¹T\« ß?¼p2^mçíÈv+®>®W¶iøñÜÎ2¨Ó&³ð¥MCìãÛWú~àÓí`+¥f{éëÍmE>óã[ Ð1\]jÖ<¶ö¶§qM±¸]ié6\.s ¹R²TÁD.5¶¤`W¹_R£¯lw'MØÅõV±"¾ÐVÈGGi²¢ &&½ñǸ}<ÄÍÝ/²ÃµtIé? K&¬±Ó&® Õ¬H7/"ÅqFé¶ ¬$&b<DÑ®©<7ßÚ¥ÇÂÒ'ql0cévB2¢$ÈÛÈT ~«> pP+Äø?îõÔìì^¢C¼dÒü¿O¢É b 5ñã A r IwEÌQÉANcø;> ÔýC¦z´ÌHÍy"ÂÐVOâ/ȦóS¹»=6ø "\«ÊæåPõÎZ (0ÅHõPxhúr/àøÊsþ±_E ³Ó}Â"fß°ºN¡oé®-³ ѯyâà8tÝT¦Á'+ÚêßSç9¸%á©ñ=¿®ôQR#º-øä{:úÃ?ÒäíuvÛi·ou°Ò¢8ÏtüÔîÞs £ÛYóM à¢`AÔV7?é»íÉCg% ¦iMß :`Qo ̤·=¾"ûÈÝò ¢sF½ÅÌjé>®Ù+g粧¹ï¤ùµzó<K9ñpm_^Ü!;Iã¹a¡£ à¨ÇõEAZi÷A¨èfÍ¥\í\îx¶0G+©YMÀÍZ7lÔÄL[Ü£ñÿ ð=ñ3MP<-´sõ éù@¤ )A7R®Ýq ¥ôóÀ;By©·Ôø¡ÅOÇKf|O$RÙæ㪠2ñç·-ý~«¤ºÃòÙÜJ׺ýc·=Äé.öWV[nI»NáÓ¿Ñ_×ä¿Sí=Py£P,æc4ÊÌ®ø5ón+TÕ8]ÏÁÓîùë¨ÌÜn¥å¶~Ê®Ê[Dë=¾¿u ©¸!¡ºÌèÎà¸ýÉLQ\Â/·Îº_ fD´[l®Ð*«2ÿ öU>Â.ú¼w dà iE«ñ [Xøörw«<ÀŦ'33ñ>v"ò7 ¡bÜí¦}«÷YÛi/î¶{¢ð½=×L¸S9e A³S¹%]µ¤Ùøº+WÐÍéA`7äTx=¨dÑ LCpØg²Ö°RW0Sn3 èX\`·ûõòÜühH\Iª³Í{wf¤²N½ÛVw\DW* ¥ßnäù.<ÍÛxU~@-9aü}6öt,%dA%±S.éøçñ1ÿ :ÝÛí ÆÀ¤îÿ âé·ïRz«Æcàÿ ÿÄ # !01 AQ"@ÿÚ ?è~ÉFû±{øÌ Q%ñÖdQ=.lðÆÄèök*T4ò# LlS,lS$Äù% ×Tu)ö] ½² È^ÉÂùD4¯Øàhõó¨zÄ8ÞÕ²Ù½²,ÔWýtéÊÐö¦ìÆÐt' 5ïævJi"2Ì¡ì ø4VòV8µóRkdèøËd¬Hhq£râ×V±.J£!³ÉúgÎÓ×Ztd) vf?btìòväÄÉOüqCéÿÄ + !10A"Q #23@BaÿÚ ?ìK0±hQKÚýÞ³?>é{ãyòæÚ}]4ä.;oåO!nÕ=uiB¼ ò F%9ÃÁR;Êl^&q[ëµUWÐ*jÑ"æÖYY4®© "ëíý¢mÂk®W§Õt]gpP7ØìÍBù$Ë-) tNM¢<¡ÜÜÐVMùiøo)¦Åz}xgñI©®,7ÊÂÙ:Hp¸ýê© C-åGéÍ2Ô±[SÉôîS%s>¬í§4;!Á È@÷Xq~ÌÛJåz]^C¤îÍm%|©Æ$&ïE9ìéâ[¿´Ç¢Å× ¤5×QÔôä. Yz§7(ìк'âýñ**ÉéE3%aýÞÐábªáÅCIw`UMb T¼ßí A3ém¥8¹ÃñÂÞ-A§vWM©Ä4 wÂ×ò¬Ø ,TÔ· ®jÿ TÑu áµÑuþ)ÑÊx+Ú_ MIó v½J<à?ñr-ò>*6اB\.ÜMµ¸»Q§»6°ÄÝA¬þÛÛq)°ZáIc7u > £N,ÐØ ÜJ4Mît{©ãÊ ðå` ¿Êcqìÿ ÿÄ ; !1A"Qa 2@q¡ð0BR±ÁÑ#Pá3br$CñÿÚ ?ê.s0(Dn+cCHÎ?ekíI'<(òM¢H¡Eºiû<L£ ÎöiMT ³ Ø+Jp05ÍÊX ôݵ¼£Ð40^!ÂðÖ %?uܯ³¶£6ÞQ s ð¶«ÅKPOL:hȤȧW`vR©Í³hÍÚbyU³ðM-ɹ[«-Êê\õ¬y'sV Ò5¯ ¬1Å5Áùi¬¡ªßDXÖÝP©ÕOIÔg"\ Æmº@Hùí?í,³lvz©ÌK{Ù³ÃDÛW à¶Â¢¥e%« ¨ë¥´RÂéXwÓûQîràá ÌpÙ¿©Èp × ¥ ìR×(´i ó0¸lü< Þt7³!hܱT ÉöV Ó Ì6cÎ=ð6eÂÚ!Âs_§h?ÅÙán#0¦*°¸QrÎ æRéÃMú,Lç0æ¸v!oa £ûC¢e`ç`´´B ×W {1Gt£ëïCìÜC U]ÐÊcì Ó§Çòöèrï@Ù 6äÛFÿ UºqÔ áºU<Óc¾îYãoÝÃù®ñ@Ü;3É»zÄòK´¤-ába¦ìQc;qNf}e¨Þ°3´ÕiµAÄ }£ZpjÒuíAögbÔx8 DöhvßTë3ÑuZxúªã¯2©³ÐtPW'jz*X*·°KÚd{ðæ'>ÑÝ-\ù,È Ë{8Åb`¸ ¼°øsß ¾.¡æ87=;V!Ä×Cëét|M½Í︷ Äx Ë §Ly©W*Ѳüû}}úº¬¡ìÐý¼ìÏAßçê¬DÖ Ó5ÊìL1h<ûQÑÍé3PTT*cÿ MâÆ¿Ô yÇVr±îú^Óܸ«"]¯"¨jØ}Ô ³ êÚÆÒ¾¼ú9¦Pe¤HáYé'o×aùë Õú^ fbѾ|´láÉÃQëÖjnå¬ÀfÑÓÛ:ì;©t.ò(ÎBz[ÂÒ6Pë8ó ×bÓ ý3»rÇdÏÓ.Ü ·³jÑGG¿6ÈÕªÎ3ÅõAq_eÊ7hD8oBÈifíâè5µÙôDëÿ W\¯#}Ä|ÕçÚXZ¶Zê¦Y²ÑLUrþÎßøîÏûOãß70lÌþ.ÔìJ d0¬Ã3vª- 2y±k8JÅñj.l|b??kâP<É¡¸åu0¸nÈ¢* 3ðñ~xr_³Å:ÍÔ y; ñü«ò+AïsÙ9 I;Í9¦âÐEÜ©ý3[2w0î3wxú¦ösK45 >·Pá !ã1yfµä ì+³éµmX´±Ç nô`@ÝÔ £2â jÑRwÿ ñælT]ÅURPɶ)קjóºZaDZL½´þ Ó³ÿ ½L! K;YíóDY44 Ã_EY§öß÷º&ÑÛÔ nÞ.ÚñX\xö¬*Óg&a¤y¬mqÞªIêÄ3£uõO5Lôív§÷®ô÷M4TRT®Q®Aã#X§e6ÓàuBiNÉÀ0a[}Ygý?5³¥B;½+èWöÅ ¬-Ý wEß)Xg£D?Á íÙêà¡hÚòiæ£uƼÔ`íBQÌç¼)³;':i´vN`³iKNÄ\zìí:9pÕÎ0sE;Ê깫H˾þ aÕMk{{E»!l Ù\ ÐrÅg]?)¶u ×yê_ÿÄ * !1AQaq¡±Ñð@Á 0áñPÿÚ ?!ûw38fXAÔ"oÏþ*àÚ TÛ&³¤½Òs´Vú'þaq¥Bè] @¶f: L× ½MqçÖj[ÉFMOxàgxWÓ 3÷кñ3ÑTÝ"êÚ \`¤QPF¸äk+¨kרsÒv Än0UFÍ%¬ o§ff?ì¢à §O·/äLÁ*Òi®#§BàùÇXî`0¼Kä7ᬹ1/ZÀ¢W Ý o§TZB½´© E¡Dx#dAøM@Òxu>Ù¤{.+êæ¨ 2\Lx@²§BA9IeH ³4twU§hP)¤ýÍ{³FaÀ ©w#øÌ ®0éìÊ8Q°øî §¬%ùGcoöö YW2¬5öÊÜõ[lÊÕuÃï´Ç¤{MP9MþvÚCÑ9 ¥ QÔÙÀ5ÑsPbe¦³ 8tÔâ`sáÖPEú*^³öö EÊQåíÇ\¢ÉÐ_ÙÖøèÊø¯´¸K7úÀ~e væ !Åq¤ªKe½ÏÜÄ»ÀòÓÒ.÷ã)É(ú*5 mXNÓ4÷ Ô´üChjF CW3<{öþCKF¸þìòHeñÒcj¨[Äë¹à·¤Ê&6fY"Õ1q=§³Zd6üW Vc©*XÉ°B;·ónCMR'ñ£o¶¹X¨]©Ì:S0ý#U(¤fö LñRÝÖ {ÂØ#Ö8 G¯ýþ×pF [8Q±wÞ¢±<Øo]ZixUÉSe!åV4{sÛ^.¢ Å)`y^C4Å, £/].Xc]ÑcßËéi©ÞFÎ ?]:âÿ ßãØG03 ²X½ê_MT$.Äáý> Pj_ÄÆnfàúÄ<o°ÓÜéON<<?¸Ò¶ÇÖõ¼§}üe½@¼lF½c-y¶}| }\ñàc£Â2¿s÷zÁ©jÛèb'Ìo _<N÷æé*×Gñ 8H`)î}7 ª¹iFË g«ý>t[R|xÃhFðÀ kGrZ½õ+{£ÇûÜB¸md`0[ÃÙÒ Á;|\ËR-¡a ÛÇ«EÕÀÃÓêµ/½ì <Èt¸Äl5 ½#Ä//púìí pÿ ·/¨éoó )ÉÎÄlÊøªÍiÔ@H#¢oô"¬J×Öâ³ê}oê?B0;T ë:û03 KòÉ«àîÝ Y\êÿ 0åjÃóËHîräÍü\ M¹Ëìló¿dh ,ïÕïá8ú,«·ßfPº c-ãJôÀ©õûfÔÌá®9óü,µ§gÑóý Q ÉìxÂ1w®Pí kB»¤×ì´mÍH4·UÜ&ÆqO^¡ôA¬M¯ÃIC68¹x}NøºL`ltO e¡©sã×µÂ!oUôÎáO? <pY£¬¬tÚü¿Ã¨¿¤ºÖ½xËuu7´©øW'â{ÃHáîÇz¿È¬e@Ù ìã<rØ2v5ü0òrté·§÷e{ùIsHmáª35^%ÅhÃ(NO7hè¯söóp¿F;FB!Hï*UÆÍ[ZWÒ¡Ø5qwäüÇÕÈiÖV= ×Ðj\Ò?Ad5Ç ïÏã è¼]¹é3Í éñÇ÷!Ö$¨3bª·¤FXÇBWÍîMEÞð£ç¢N~~b¶Æ/Ãûë F.Ñ:Æi9ënøùÒ5:¯ZL/è.¹ý <oÙ 1/ßÂÓà ãèÎ÷¹õ.öß}Þþaò²3,ë¿?5ÔU;çR, ªð6öÍú4ÉUJ4_ ·ö¿ËL~à,6Û&bW¢ qE8¢|¦!àÓÚ=s¹5¯<¦ÑÐß äßE¨»Ì£Q&cQAâ©! DSPU'Î4 ^IÑù¤3¦h¹tÝ}¬ÝvQwÔ º¸+CÒå¬JÕ:@Rô, Y8j¨ Ñ¡üA |È FZJvxñÌèêË»ïH¼oÒ à-f2ûDÄDz7 ¯Bh¿ä_¶µÛ]PuÉ\Rdâvõ%ÜÊ¡ÑêéÈÓ?'ÙªL¡#ð|´»~\Þ()zðô~d÷z¥H5G<³ÁM¸zJ©õ?0|;aB_Uá ÛZ}íûþeçUCÕù©í§6F; ùùÓ[C¬óØ~Ñŵ¶yv|^ÍY¡Ü²V>4Hà oëÝÍOù°ÝJ»Êa>aó§¡*äi ñ§Oû×3I·(@æ.\tzÞÑÔcÕÊ]dðf õí M%Ù zßXyZ}¶X6V³v¼ ø@²Ú=Ôî·´;Ìr áúòç ª*H(6ôÛÊZ]GLµÒA¡:2æÆQZgü>ÐÖÞ{ÞÏxKð_·«5;û¥¬³÷iPàñ µN®L.¦B¾?w00Äw D êÊ´üàªa.ë/xv%° ¿pÙ»îzz)Æ«¶ß§´Fë ¤C 6/ë¢ ðÿ à$S2Üì[7_ööñ"NÑ¡« ´« ¶Ýñ úhºeíôÒi×aÁV peù°}ÿÚ óÏ<óÏ<Æ/üóÏ<óÏ<óÎ2û¯à¿ÿ óÏ<óÏ<óÎI©Ýh¡tóÏ<óÏ<ð)Ù×,&Ì6vÿ ͼóÏ<ò7ëDj9ßþ~o¦óÏ<óÇäÌ\ÎB-!3óÏ<óÏ<æ ³JKG<óÏ<¹ä+]iPZnE¼óÏ<ðÃn¦³¥%ª¨£+|óÏ<óÏ<"¡Wu"òug¼óÏ<óÏ<æ$ü{¾Ï<óÏ<óÏ<òõÝ[Ï<óÏ<óÏ<óÏ<óÀ¾óÏ<óÏ<ÿÄ !10A Qa@ÿÚ ?ð.ÄÇù|òçc L9h¤#L`@:u Ù"NÅÆ.S÷ÄG!êÀq.ߤÚX@õð¸Ã²Láðúnc@!)o6N?/ê¯ÓÉ¿ÙNö+ÜÇ￬ àñk2CÕ®þ exH]ÛÝ#ÿ ¾Áì03 <[<° äþ]¤GF̧sîE¤ m ê 6óHORËÌ l ]OèXñ¹dûõ¶²-#9°-,rwcÌpzm8a}O{Ûâ}l°È[" Z \ énõk¾6ãñ`hÈåÔÏ9Ë®ù82÷ L9þ5SÖZïÿÄ ) !1AQað0q¡±ÁÑ áñ@ÿÚ ?ì¨é,íDÞ äYcEº#G ¼DE sú:OgTÌI¹£F{GrMGÆ:ÜRÖ nå;د O~É7ã2+hIJ:A«á2O]}ÁYG\P4Vâ¥î{!¾Á~ Ø ÐË.¿:IÞìs]ØÉåQ°àºë§Æм¸º|'¿÷÷©É8% íÁä÷Êñã58-L ×îCk_#IüÞx Î}ÛãéÚÎÖ9 ðvîÎòÔbâT¥1 Õ¨èõÇX%q5ïó3Ƚ? Ãç¯DâfA ò¸¥ôx'Uμùû8ÄiõØÝé{ ©~kí¤Aò߶¼&é³ Gj¥Ó¿o=>³.øÐSJ~ûï2è²ë÷ÕxÄ-'®½j *4àþ¹øLá¤yèìîL?5rÄXHâ8°BnôðçÄõ<#HêA þ&r*+Þ'̵°ôúö7FúÏ×Ì2l`Lä½ùubÆÅÝ/¿8À² ß Ê~å¥Î'¯â+¢\¤É0µÜ Ê£8W]tLW z HEڴ׿övHZ1PµÇG¯ W=&RnLãHSÒc¦Ý»ùAutHKi(ì ´ 8ÊJзå.·#Èí\½`Û´Q×,±¶ï êà*ñEÄq4BØÿ ÿÄ * !1AQaq@¡±Ñð 0ÁPñáÿÚ ?üc £ ûYkÜe+JqÈw6<a `^ vG-ëÿ ô¥_:L¦í¶«8®ÛÕ¼¦¸ÈsOBoX$©6(Ôx|å§C½kÃ`3 5Gÿ p ABeý8ä7Æ<½3í ÿ TÀ9\²ºP4vlÂ4mõðþóË8ûÏëÞÿ Èÿ |à «- çgt=oh]Âr=þ`ÁHÀ¼æýP!ö'©ì7eI©©§ÏÜ3¸H½÷ø¤å@èö½öLãRù>qJ46Ð]v ¨ ¨¸ zß5ÄÕ+OÛ¬¼jjÔù>·ñÔ! ÿ MÚÌZ ®, O{~¸)Dt× ë[;T hòü¹(NÂ3¯Y Iê÷íÓ¿¦R á³ 0Æ*xÁýüxp& »AËãöp1IôkëB'l\È:§&-8"áûîð³J×;>ücDlÂÜ]1¦ë6Õ¸UM?|c6¥uæ,8 -sº¯F¹ü³-Rs WÕ>r!Ä[ØÖÿ Q?¦_ì [xý?û$:í® $ÑàÃDDÐ[&ü fýJ#Èe>:Ö¦ÂJØx5Чê>#õÆ@±¬A!TþíßQ :Øò_êbùK¼&Áã¦G øQP¿Wì$møìDM8ÌEý^¼&& âèxÜþ`5ô"oÐ¯Ê iúÔð]² u¾*ë 75³W½ÆkÊQaa¯¥øyÍ=½@Eñÿ 1AFqÄÂ&ó ëÉä ¦í åAz#VÎÒµ$! W ¡>AÈäÞ)Û¯ v Ñùn5ë%ùÛá#õ<eôN2ÿ ìç¿8@EJ¼3P<ë4 0^ðùÛÎÅ"îGj®w«£ÞÚz26w®þúá7] Ãf®²_É(«K>ô ¯Æ«Q§8ù5¤ô} &7ÐHG± º TR>7Ó õI _N dÞZírxüÿ 9fón![uMÙÖÞ|}.Jó® 7M` <M°7ÄH>WìY$wèÌdh~²ßÖE¦ãÙÔÉQ±ÛÇVÙiD=Iüà*ÍqÀFrÖè¿|sþ>ó û"+=ö#ŧ8Ü88 ÄÁèoq°íÜاÌ˦HÑwç4Oa»è 5X¯ßHö#Þ Ï¨i{ýp4cGȱ ±)X'1AÂ* ¶P¹¥µ¾ÛßÏý ³&Êp§®ÍyÆU;ó¨L ALØ1äX{rà À7ß\±>åéÿ %·ü®:o6L6>áìûw»MAY§£È]Øljt ë+Ñ ¢ø0` R *øAÞõ ¾]ö:Ízʪy%Ñï·¿/ö%ª"pë £©ÕdǶ5Õ¨«i׫TÄÐEî#Å)GÒd)É^µ«|n)iHDu¤MXóc Û¸ÐÀýC zæ-Lé¾·O¼Õz>|`(uϬA;¾Giá{8yÓj$zgý¾áø-1*¨*ÖÄUMùR âcRöØóþ; Qûbó¤¢SñöK:úây ï>|óç lÐ$:lú!Zy8@|°¿hðÓß) §CÈts47 £È Ro]ç=FÆ»wþç $¬ýû`ùÐ3Èèh®ß L¬Ö h6NuÂt átî ªÅÙjV¬ßF+qãÞñ:£Gn¸+m=~µõÂ.ÓHðå¨õãðJ< K¥Fø^#\'KÜà oI %?%뫵àQÎseeTÛØ¯Þ Ô ÔÁNlì§O5Lmöùx?;÷ &Hã`ÑÊàñ{?¼ï °TS iKFÂÿ ¾]¢¬ÙÀðq/@¦ CÒüÜ>xFÇ L i*ÔUND×`-½MúCBrñ.+Âr>Ggxoðb3n%(Q*Ùà 1fÜ0ié^àmløÀæ§ýOü @C£÷ õÆÙÎRH« [`®¼{Ä>ññh ô61äãDyHk÷rS¤¤=ÅTcã#/XGë:Ð °"»UÚò \ßÁêu) 6ã7¡^'~GJ_Lò`mTí EYB1wK>°¸1À9aFÛòV%pdâ!(ìÑ6''²Q³H">ÀýsEO¤)ò:q u± ¸VC$h A¨-ý£õÈ÷Vü ýÃÀøëøúa 9 P\ò×" Âü3R¦ÅÙñqE¼ôÁ= tW3e²'ÈìÇ `°^Å|¸(pÿ G»Ùß[ 8Y(ã{,êYöî ¥ZàFª4[%! AE Æ~CFв2°§XQî : ÞQÑÙ@^JiÐüÐW\Á¥1ý¡ç¥Öw¥ Ô7ÈÄðû/HÀðº-£` D#ßá%X¸:- 1tå69&µ*ÍÌõø(êYÈ7âk/xCsiS³Á6?|nקC×Ù±ï *hç)>¸¥7ygr8ìÆ ð\÷A Óé:¸gÆ^ÓÁùN>í· >§Èd D¯ K3Ú"5yÒÑÐéq5ÙD ©×fͤkO.[/ûÀ1ÆDU×0tjÞ?_¾-%$+¥ 2ñÄpõ¯òu8Ý~N ±^öKÐnV#½ '¥Å:aè "vc8Å{:Q®0±°½§½ððíø¦þ_Ö?\ xc£Cföö£4{ÄTc(ǬBÓ_°ò ÷ë¥y<!ºy23y´$ØZ{Õ¡¢c÷\Jè©6jr 5£þÑ®§Ù,%ÓUy×˵«|M[Ûiüâ®jõ)§àßÕÄ ½éDù³Õeo³|vþs 2vT)µäª,Óéw!þ 95ìw÷G>Ì"YBE£rù5Õü )Ý·É:{BÉH)ðÒ{1_ò¨ ]ÎO¨§×u¼³|&ó]ëYNÈùÊeªSáxbð誳¡iD£ñÎô I<ø>¡ÆuÙ8û¸ .°Ì3IØ7%.F»^³$DÙi) R¨(&êÁÆÔ©Uá¨6û8»gÑäÎ%(ûñÇ(vº ¦Z]xçð I¯5¿¹xéãMÒà ½nç ³gî}Mý2#ÓÀ;ºÕà ` K FÄ{x.ªTç Hûüw[ÉõÁA,LÙIðÇñ1Ø<¯ÎT¸Ò#^¿Î*ªlr*WË-?#´æ;:¸4 8ÃfQXO O¼WÓ°¹?½L`"%`8+âßY-Ôìår>F aÎBJÝuÄÁ® èl÷þÕ¨µ þ&H¤äjº`Ûûñí`¨`y MñX-ãõÏbÿ » !¡AÀ¨aÆä\"Ò1À2tññõ9$¯IÁ ß6\J IýÆzL-¤4ë ðµ®B:gX Bð=sý÷GéV¥.Î>q¢ìÅ>áÖÓCåÖöªÖ÷ û]¯É¼@¥ÀÆA;®`U] Û Ydß!D!eàâ.¿ùGCõþk=xÎ 5rAü bòõ ÇÔ$Êä ª9kr¨çoßùÊÎOyð[Þ"X¯üï¼tc©ÕtøçÕQ¬\^XÓ°Û ³¿¶)ÊPý& ±F©ïÃüà^ÜMtʳgǨ6¯Ýûäm'gå5E<TF ÉS-àì Zðý1ëpÃúùÃ¥×ú8Á =lä¶.ÝðhØxÀÈÑ'¬}!7¬1%z®äSæ¼l+â*¼Â ¶Dqµµð8ã¶`mGef¢l"'©®NúpØÃÉámà§aåØâ¡üfò¨n´³n_çxÑL4 × è )?ÏG ¯/è}¿,\ 1dÎYBz9>R¯6çgõÄáhln pßE^Z»: N¿''yÍèó6Öâ7÷1Ã`'NÃÛôÄÕJá¾þ¿¦H ^×7çIï (6 \²ÝÒ+Á~ cB]]Ý Ó¦¢x1p*µ;aè8 måØý.ÀBñG7ÇR'Y i˽»À(G?Ö*ÃÔg,ªâõ§¼Á ©×ÆYÒ8|:ÍA¨¶Y/`¡ ¶þN 5 H¯Z0ÂT<¦ò"/ Aê;C¡Ò {ûúÁ"`5CÎirzæ öÌ£SFÏ~Æ é $'ÑÏvñÂyuña°k þ¦ ê¢ÉÓGýçÖi+i»÷ò~ÙÖí À(Àd¿oü0 3Iáðñª¡«¢;Ou¹ _F¸ºÞøÁK'-^8¯+ÿ Ièrøç¼ìPÙk>Çÿ Íä¦b l ìY_Èÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 11465 |
| Response Body - size: 11,465 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ å ¬×5æê{¬N=yT_S$ ¢Õ+kËô¨¼\±ÒnriËýÛfë fy»[._&º~vÇõåÉY,o¯Ì îËççÅØün3Lí¸KÇ/÷¬ÂÞ'XŸ{ XÛ"Jjo ±xÜÕ£h½ûÜ¡Ý ùs:ǼÛtÌ^ó6ÇͳåÒý¹~ñÓ-F··o%T K¯Ú#ù:ÔVÝI,dcYGúYï¯HôÜ¡"õ ê;G Êùz÷t½ËÁÖ¼DßJ¥@ßkªÑkÛ~g1®JÆé9 £IÊ!MMèréNÈ>Ò=ùnÁÞzçZ×z%Î;ðKïò Lì<J%û¶Ï®òÛ¸JÕ6_\ØþãynæOk·åÑoùjé´ûMáç¾òͶäì]«õcmä-MîS{ÜãAä_Kq{-@{x Wná]_ÃèÎæuɼj%ÃÉ?ÌNWª°,e±LÏlÌ£ËåZ(ÇT-]§È³zý+MØ325 OϺ¯õØvë¥^X ²ëUÒzóζo¯=ÇkõÆé7¦åä>DÃÉbrÖâȪ«W|© l;Úo±dVµù«Åÿ =e8r¥tÚ¾=Ö*Ú77LÒa Üyï¹[# +J¶]iYë7Ïxý;6ÇÍz>ÕoÞD= F¹{ãêEé¶zC*åîá¦Ö²0y&ËÕ«5®Xj Ô©=þP û_è¼mYO x}Y{/cl&L$B¯ûÝ]vÞvòcÎ̶Ií5æ IZkÚ«Z÷y|µK³ =ª®íoÂìÍMקg98À§_Æâ½nmþö»îVÂa/Åô1°êÈu+Üâ_&ñw¬öä Å7P÷)é0y> ²zu=" |ïÅU) fóç=ñ:ÙBð ÿÄ + !"@#01 3$2PAÿÚ ø:8DºW¸Â¿âZéÃ+J ¹T\« ß?¼p2^mçíÈv+®>®W¶iøñÜÎ2¨Ó&³ð¥MCìãÛWú~àÓí`+¥f{éëÍmE>óã[ Ð1\]jÖ<¶ö¶§qM±¸]ié6\.s ¹R²TÁD.5¶¤`W¹_R£¯lw'MØÅõV±"¾ÐVÈGGi²¢ &&½ñǸ}<ÄÍÝ/²ÃµtIé? K&¬±Ó&® Õ¬H7/"ÅqFé¶ ¬$&b<DÑ®©<7ßÚ¥ÇÂÒ'ql0cévB2¢$ÈÛÈT ~«> pP+Äø?îõÔìì^¢C¼dÒü¿O¢É b 5ñã A r IwEÌQÉANcø;> ÔýC¦z´ÌHÍy"ÂÐVOâ/ȦóS¹»=6ø "\«ÊæåPõÎZ (0ÅHõPxhúr/àøÊsþ±_E ³Ó}Â"fß°ºN¡oé®-³ ѯyâà8tÝT¦Á'+ÚêßSç9¸%á©ñ=¿®ôQR#º-øä{:úÃ?ÒäíuvÛi·ou°Ò¢8ÏtüÔîÞs £ÛYóM à¢`AÔV7?é»íÉCg% ¦iMß :`Qo ̤·=¾"ûÈÝò ¢sF½ÅÌjé>®Ù+g粧¹ï¤ùµzó<K9ñpm_^Ü!;Iã¹a¡£ à¨ÇõEAZi÷A¨èfÍ¥\í\îx¶0G+©YMÀÍZ7lÔÄL[Ü£ñÿ ð=ñ3MP<-´sõ éù@¤ )A7R®Ýq ¥ôóÀ;By©·Ôø¡ÅOÇKf|O$RÙæ㪠2ñç·-ý~«¤ºÃòÙÜJ׺ýc·=Äé.öWV[nI»NáÓ¿Ñ_×ä¿Sí=Py£P,æc4ÊÌ®ø5ón+TÕ8]ÏÁÓîùë¨ÌÜn¥å¶~Ê®Ê[Dë=¾¿u ©¸!¡ºÌèÎà¸ýÉLQ\Â/·Îº_ fD´[l®Ð*«2ÿ öU>Â.ú¼w dà iE«ñ [Xøörw«<ÀŦ'33ñ>v"ò7 ¡bÜí¦}«÷YÛi/î¶{¢ð½=×L¸S9e A³S¹%]µ¤Ùøº+WÐÍéA`7äTx=¨dÑ LCpØg²Ö°RW0Sn3 èX\`·ûõòÜühH\Iª³Í{wf¤²N½ÛVw\DW* ¥ßnäù.<ÍÛxU~@-9aü}6öt,%dA%±S.éøçñ1ÿ :ÝÛí ÆÀ¤îÿ âé·ïRz«Æcàÿ ÿÄ # !01 AQ"@ÿÚ ?è~ÉFû±{øÌ Q%ñÖdQ=.lðÆÄèök*T4ò# LlS,lS$Äù% ×Tu)ö] ½² È^ÉÂùD4¯Øàhõó¨zÄ8ÞÕ²Ù½²,ÔWýtéÊÐö¦ìÆÐt' 5ïævJi"2Ì¡ì ø4VòV8µóRkdèøËd¬Hhq£râ×V±.J£!³ÉúgÎÓ×Ztd) vf?btìòväÄÉOüqCéÿÄ + !10A"Q #23@BaÿÚ ?ìK0±hQKÚýÞ³?>é{ãyòæÚ}]4ä.;oåO!nÕ=uiB¼ ò F%9ÃÁR;Êl^&q[ëµUWÐ*jÑ"æÖYY4®© "ëíý¢mÂk®W§Õt]gpP7ØìÍBù$Ë-) tNM¢<¡ÜÜÐVMùiøo)¦Åz}xgñI©®,7ÊÂÙ:Hp¸ýê© C-åGéÍ2Ô±[SÉôîS%s>¬í§4;!Á È@÷Xq~ÌÛJåz]^C¤îÍm%|©Æ$&ïE9ìéâ[¿´Ç¢Å× ¤5×QÔôä. Yz§7(ìк'âýñ**ÉéE3%aýÞÐábªáÅCIw`UMb T¼ßí A3ém¥8¹ÃñÂÞ-A§vWM©Ä4 wÂ×ò¬Ø ,TÔ· ®jÿ TÑu áµÑuþ)ÑÊx+Ú_ MIó v½J<à?ñr-ò>*6اB\.ÜMµ¸»Q§»6°ÄÝA¬þÛÛq)°ZáIc7u > £N,ÐØ ÜJ4Mît{©ãÊ ðå` ¿Êcqìÿ ÿÄ ; !1A"Qa 2@q¡ð0BR±ÁÑ#Pá3br$CñÿÚ ?ê.s0(Dn+cCHÎ?ekíI'<(òM¢H¡Eºiû<L£ ÎöiMT ³ Ø+Jp05ÍÊX ôݵ¼£Ð40^!ÂðÖ %?uܯ³¶£6ÞQ s ð¶«ÅKPOL:hȤȧW`vR©Í³hÍÚbyU³ðM-ɹ[«-Êê\õ¬y'sV Ò5¯ ¬1Å5Áùi¬¡ªßDXÖÝP©ÕOIÔg"\ Æmº@Hùí?í,³lvz©ÌK{Ù³ÃDÛW à¶Â¢¥e%« ¨ë¥´RÂéXwÓûQîràá ÌpÙ¿©Èp × ¥ ìR×(´i ó0¸lü< Þt7³!hܱT ÉöV Ó Ì6cÎ=ð6eÂÚ!Âs_§h?ÅÙán#0¦*°¸QrÎ æRéÃMú,Lç0æ¸v!oa £ûC¢e`ç`´´B ×W {1Gt£ëïCìÜC U]ÐÊcì Ó§Çòöèrï@Ù 6äÛFÿ UºqÔ áºU<Óc¾îYãoÝÃù®ñ@Ü;3É»zÄòK´¤-ába¦ìQc;qNf}e¨Þ°3´ÕiµAÄ }£ZpjÒuíAögbÔx8 DöhvßTë3ÑuZxúªã¯2©³ÐtPW'jz*X*·°KÚd{ðæ'>ÑÝ-\ù,È Ë{8Åb`¸ ¼°øsß ¾.¡æ87=;V!Ä×Cëét|M½Í︷ Äx Ë §Ly©W*Ѳüû}}úº¬¡ìÐý¼ìÏAßçê¬DÖ Ó5ÊìL1h<ûQÑÍé3PTT*cÿ MâÆ¿Ô yÇVr±îú^Óܸ«"]¯"¨jØ}Ô ³ êÚÆÒ¾¼ú9¦Pe¤HáYé'o×aùë Õú^ fbѾ|´láÉÃQëÖjnå¬ÀfÑÓÛ:ì;©t.ò(ÎBz[ÂÒ6Pë8ó ×bÓ ý3»rÇdÏÓ.Ü ·³jÑGG¿6ÈÕªÎ3ÅõAq_eÊ7hD8oBÈifíâè5µÙôDëÿ W\¯#}Ä|ÕçÚXZ¶Zê¦Y²ÑLUrþÎßøîÏûOãß70lÌþ.ÔìJ d0¬Ã3vª- 2y±k8JÅñj.l|b??kâP<É¡¸åu0¸nÈ¢* 3ðñ~xr_³Å:ÍÔ y; ñü«ò+AïsÙ9 I;Í9¦âÐEÜ©ý3[2w0î3wxú¦ösK45 >·Pá !ã1yfµä ì+³éµmX´±Ç nô`@ÝÔ £2â jÑRwÿ ñælT]ÅURPɶ)קjóºZaDZL½´þ Ó³ÿ ½L! K;YíóDY44 Ã_EY§öß÷º&ÑÛÔ nÞ.ÚñX\xö¬*Óg&a¤y¬mqÞªIêÄ3£uõO5Lôív§÷®ô÷M4TRT®Q®Aã#X§e6ÓàuBiNÉÀ0a[}Ygý?5³¥B;½+èWöÅ ¬-Ý wEß)Xg£D?Á íÙêà¡hÚòiæ£uƼÔ`íBQÌç¼)³;':i´vN`³iKNÄ\zìí:9pÕÎ0sE;Ê깫H˾þ aÕMk{{E»!l Ù\ ÐrÅg]?)¶u ×yê_ÿÄ * !1AQaq¡±Ñð@Á 0áñPÿÚ ?!ûw38fXAÔ"oÏþ*àÚ TÛ&³¤½Òs´Vú'þaq¥Bè] @¶f: L× ½MqçÖj[ÉFMOxàgxWÓ 3÷кñ3ÑTÝ"êÚ \`¤QPF¸äk+¨kרsÒv Än0UFÍ%¬ o§ff?ì¢à §O·/äLÁ*Òi®#§BàùÇXî`0¼Kä7ᬹ1/ZÀ¢W Ý o§TZB½´© E¡Dx#dAøM@Òxu>Ù¤{.+êæ¨ 2\Lx@²§BA9IeH ³4twU§hP)¤ýÍ{³FaÀ ©w#øÌ ®0éìÊ8Q°øî §¬%ùGcoöö YW2¬5öÊÜõ[lÊÕuÃï´Ç¤{MP9MþvÚCÑ9 ¥ QÔÙÀ5ÑsPbe¦³ 8tÔâ`sáÖPEú*^³öö EÊQåíÇ\¢ÉÐ_ÙÖøèÊø¯´¸K7úÀ~e væ !Åq¤ªKe½ÏÜÄ»ÀòÓÒ.÷ã)É(ú*5 mXNÓ4÷ Ô´üChjF CW3<{öþCKF¸þìòHeñÒcj¨[Äë¹à·¤Ê&6fY"Õ1q=§³Zd6üW Vc©*XÉ°B;·ónCMR'ñ£o¶¹X¨]©Ì:S0ý#U(¤fö LñRÝÖ {ÂØ#Ö8 G¯ýþ×pF [8Q±wÞ¢±<Øo]ZixUÉSe!åV4{sÛ^.¢ Å)`y^C4Å, £/].Xc]ÑcßËéi©ÞFÎ ?]:âÿ ßãØG03 ²X½ê_MT$.Äáý> Pj_ÄÆnfàúÄ<o°ÓÜéON<<?¸Ò¶ÇÖõ¼§}üe½@¼lF½c-y¶}| }\ñàc£Â2¿s÷zÁ©jÛèb'Ìo _<N÷æé*×Gñ 8H`)î}7 ª¹iFË g«ý>t[R|xÃhFðÀ kGrZ½õ+{£ÇûÜB¸md`0[ÃÙÒ Á;|\ËR-¡a ÛÇ«EÕÀÃÓêµ/½ì <Èt¸Äl5 ½#Ä//púìí pÿ ·/¨éoó )ÉÎÄlÊøªÍiÔ@H#¢oô"¬J×Öâ³ê}oê?B0;T ë:û03 KòÉ«àîÝ Y\êÿ 0åjÃóËHîräÍü\ M¹Ëìló¿dh ,ïÕïá8ú,«·ßfPº c-ãJôÀ©õûfÔÌá®9óü,µ§gÑóý Q ÉìxÂ1w®Pí kB»¤×ì´mÍH4·UÜ&ÆqO^¡ôA¬M¯ÃIC68¹x}NøºL`ltO e¡©sã×µÂ!oUôÎáO? <pY£¬¬tÚü¿Ã¨¿¤ºÖ½xËuu7´©øW'â{ÃHáîÇz¿È¬e@Ù ìã<rØ2v5ü0òrté·§÷e{ùIsHmáª35^%ÅhÃ(NO7hè¯söóp¿F;FB!Hï*UÆÍ[ZWÒ¡Ø5qwäüÇÕÈiÖV= ×Ðj\Ò?Ad5Ç ïÏã è¼]¹é3Í éñÇ÷!Ö$¨3bª·¤FXÇBWÍîMEÞð£ç¢N~~b¶Æ/Ãûë F.Ñ:Æi9ënøùÒ5:¯ZL/è.¹ý <oÙ 1/ßÂÓà ãèÎ÷¹õ.öß}Þþaò²3,ë¿?5ÔU;çR, ªð6öÍú4ÉUJ4_ ·ö¿ËL~à,6Û&bW¢ qE8¢|¦!àÓÚ=s¹5¯<¦ÑÐß äßE¨»Ì£Q&cQAâ©! DSPU'Î4 ^IÑù¤3¦h¹tÝ}¬ÝvQwÔ º¸+CÒå¬JÕ:@Rô, Y8j¨ Ñ¡üA |È FZJvxñÌèêË»ïH¼oÒ à-f2ûDÄDz7 ¯Bh¿ä_¶µÛ]PuÉ\Rdâvõ%ÜÊ¡ÑêéÈÓ?'ÙªL¡#ð|´»~\Þ()zðô~d÷z¥H5G<³ÁM¸zJ©õ?0|;aB_Uá ÛZ}íûþeçUCÕù©í§6F; ùùÓ[C¬óØ~Ñŵ¶yv|^ÍY¡Ü²V>4Hà oëÝÍOù°ÝJ»Êa>aó§¡*äi ñ§Oû×3I·(@æ.\tzÞÑÔcÕÊ]dðf õí M%Ù zßXyZ}¶X6V³v¼ ø@²Ú=Ôî·´;Ìr áúòç ª*H(6ôÛÊZ]GLµÒA¡:2æÆQZgü>ÐÖÞ{ÞÏxKð_·«5;û¥¬³÷iPàñ µN®L.¦B¾?w00Äw D êÊ´üàªa.ë/xv%° ¿pÙ»îzz)Æ«¶ß§´Fë ¤C 6/ë¢ ðÿ à$S2Üì[7_ööñ"NÑ¡« ´« ¶Ýñ úhºeíôÒi×aÁV peù°}ÿÚ óÏ<óÏ<Æ/üóÏ<óÏ<óÎ2û¯à¿ÿ óÏ<óÏ<óÎI©Ýh¡tóÏ<óÏ<ð)Ù×,&Ì6vÿ ͼóÏ<ò7ëDj9ßþ~o¦óÏ<óÇäÌ\ÎB-!3óÏ<óÏ<æ ³JKG<óÏ<¹ä+]iPZnE¼óÏ<ðÃn¦³¥%ª¨£+|óÏ<óÏ<"¡Wu"òug¼óÏ<óÏ<æ$ü{¾Ï<óÏ<óÏ<òõÝ[Ï<óÏ<óÏ<óÏ<óÀ¾óÏ<óÏ<ÿÄ !10A Qa@ÿÚ ?ð.ÄÇù|òçc L9h¤#L`@:u Ù"NÅÆ.S÷ÄG!êÀq.ߤÚX@õð¸Ã²Láðúnc@!)o6N?/ê¯ÓÉ¿ÙNö+ÜÇ￬ àñk2CÕ®þ exH]ÛÝ#ÿ ¾Áì03 <[<° äþ]¤GF̧sîE¤ m ê 6óHORËÌ l ]OèXñ¹dûõ¶²-#9°-,rwcÌpzm8a}O{Ûâ}l°È[" Z \ énõk¾6ãñ`hÈåÔÏ9Ë®ù82÷ L9þ5SÖZïÿÄ ) !1AQað0q¡±ÁÑ áñ@ÿÚ ?ì¨é,íDÞ äYcEº#G ¼DE sú:OgTÌI¹£F{GrMGÆ:ÜRÖ nå;د O~É7ã2+hIJ:A«á2O]}ÁYG\P4Vâ¥î{!¾Á~ Ø ÐË.¿:IÞìs]ØÉåQ°àºë§Æм¸º|'¿÷÷©É8% íÁä÷Êñã58-L ×îCk_#IüÞx Î}ÛãéÚÎÖ9 ðvîÎòÔbâT¥1 Õ¨èõÇX%q5ïó3Ƚ? Ãç¯DâfA ò¸¥ôx'Uμùû8ÄiõØÝé{ ©~kí¤Aò߶¼&é³ Gj¥Ó¿o=>³.øÐSJ~ûï2è²ë÷ÕxÄ-'®½j *4àþ¹øLá¤yèìîL?5rÄXHâ8°BnôðçÄõ<#HêA þ&r*+Þ'̵°ôúö7FúÏ×Ì2l`Lä½ùubÆÅÝ/¿8À² ß Ê~å¥Î'¯â+¢\¤É0µÜ Ê£8W]tLW z HEڴ׿övHZ1PµÇG¯ W=&RnLãHSÒc¦Ý»ùAutHKi(ì ´ 8ÊJзå.·#Èí\½`Û´Q×,±¶ï êà*ñEÄq4BØÿ ÿÄ * !1AQaq@¡±Ñð 0ÁPñáÿÚ ?üc £ ûYkÜe+JqÈw6<a `^ vG-ëÿ ô¥_:L¦í¶«8®ÛÕ¼¦¸ÈsOBoX$©6(Ôx|å§C½kÃ`3 5Gÿ p ABeý8ä7Æ<½3í ÿ TÀ9\²ºP4vlÂ4mõðþóË8ûÏëÞÿ Èÿ |à «- çgt=oh]Âr=þ`ÁHÀ¼æýP!ö'©ì7eI©©§ÏÜ3¸H½÷ø¤å@èö½öLãRù>qJ46Ð]v ¨ ¨¸ zß5ÄÕ+OÛ¬¼jjÔù>·ñÔ! ÿ MÚÌZ ®, O{~¸)Dt× ë[;T hòü¹(NÂ3¯Y Iê÷íÓ¿¦R á³ 0Æ*xÁýüxp& »AËãöp1IôkëB'l\È:§&-8"áûîð³J×;>ücDlÂÜ]1¦ë6Õ¸UM?|c6¥uæ,8 -sº¯F¹ü³-Rs WÕ>r!Ä[ØÖÿ Q?¦_ì [xý?û$:í® $ÑàÃDDÐ[&ü fýJ#Èe>:Ö¦ÂJØx5Чê>#õÆ@±¬A!TþíßQ :Øò_êbùK¼&Áã¦G øQP¿Wì$møìDM8ÌEý^¼&& âèxÜþ`5ô"oÐ¯Ê iúÔð]² u¾*ë 75³W½ÆkÊQaa¯¥øyÍ=½@Eñÿ 1AFqÄÂ&ó ëÉä ¦í åAz#VÎÒµ$! W ¡>AÈäÞ)Û¯ v Ñùn5ë%ùÛá#õ<eôN2ÿ ìç¿8@EJ¼3P<ë4 0^ðùÛÎÅ"îGj®w«£ÞÚz26w®þúá7] Ãf®²_É(«K>ô ¯Æ«Q§8ù5¤ô} &7ÐHG± º TR>7Ó õI _N dÞZírxüÿ 9fón![uMÙÖÞ|}.Jó® 7M` <M°7ÄH>WìY$wèÌdh~²ßÖE¦ãÙÔÉQ±ÛÇVÙiD=Iüà*ÍqÀFrÖè¿|sþ>ó û"+=ö#ŧ8Ü88 ÄÁèoq°íÜاÌ˦HÑwç4Oa»è 5X¯ßHö#Þ Ï¨i{ýp4cGȱ ±)X'1AÂ* ¶P¹¥µ¾ÛßÏý ³&Êp§®ÍyÆU;ó¨L ALØ1äX{rà À7ß\±>åéÿ %·ü®:o6L6>áìûw»MAY§£È]Øljt ë+Ñ ¢ø0` R *øAÞõ ¾]ö:Ízʪy%Ñï·¿/ö%ª"pë £©ÕdǶ5Õ¨«i׫TÄÐEî#Å)GÒd)É^µ«|n)iHDu¤MXóc Û¸ÐÀýC zæ-Lé¾·O¼Õz>|`(uϬA;¾Giá{8yÓj$zgý¾áø-1*¨*ÖÄUMùR âcRöØóþ; Qûbó¤¢SñöK:úây ï>|óç lÐ$:lú!Zy8@|°¿hðÓß) §CÈts47 £È Ro]ç=FÆ»wþç $¬ýû`ùÐ3Èèh®ß L¬Ö h6NuÂt átî ªÅÙjV¬ßF+qãÞñ:£Gn¸+m=~µõÂ.ÓHðå¨õãðJ< K¥Fø^#\'KÜà oI %?%뫵àQÎseeTÛØ¯Þ Ô ÔÁNlì§O5Lmöùx?;÷ &Hã`ÑÊàñ{?¼ï °TS iKFÂÿ ¾]¢¬ÙÀðq/@¦ CÒüÜ>xFÇ L i*ÔUND×`-½MúCBrñ.+Âr>Ggxoðb3n%(Q*Ùà 1fÜ0ié^àmløÀæ§ýOü @C£÷ õÆÙÎRH« [`®¼{Ä>ññh ô61äãDyHk÷rS¤¤=ÅTcã#/XGë:Ð °"»UÚò \ßÁêu) 6ã7¡^'~GJ_Lò`mTí EYB1wK>°¸1À9aFÛòV%pdâ!(ìÑ6''²Q³H">ÀýsEO¤)ò:q u± ¸VC$h A¨-ý£õÈ÷Vü ýÃÀøëøúa 9 P\ò×" Âü3R¦ÅÙñqE¼ôÁ= tW3e²'ÈìÇ `°^Å|¸(pÿ G»Ùß[ 8Y(ã{,êYöî ¥ZàFª4[%! AE Æ~CFв2°§XQî : ÞQÑÙ@^JiÐüÐW\Á¥1ý¡ç¥Öw¥ Ô7ÈÄðû/HÀðº-£` D#ßá%X¸:- 1tå69&µ*ÍÌõø(êYÈ7âk/xCsiS³Á6?|nקC×Ù±ï *hç)>¸¥7ygr8ìÆ ð\÷A Óé:¸gÆ^ÓÁùN>í· >§Èd D¯ K3Ú"5yÒÑÐéq5ÙD ©×fͤkO.[/ûÀ1ÆDU×0tjÞ?_¾-%$+¥ 2ñÄpõ¯òu8Ý~N ±^öKÐnV#½ '¥Å:aè "vc8Å{:Q®0±°½§½ððíø¦þ_Ö?\ xc£Cföö£4{ÄTc(ǬBÓ_°ò ÷ë¥y<!ºy23y´$ØZ{Õ¡¢c÷\Jè©6jr 5£þÑ®§Ù,%ÓUy×˵«|M[Ûiüâ®jõ)§àßÕÄ ½éDù³Õeo³|vþs 2vT)µäª,Óéw!þ 95ìw÷G>Ì"YBE£rù5Õü )Ý·É:{BÉH)ðÒ{1_ò¨ ]ÎO¨§×u¼³|&ó]ëYNÈùÊeªSáxbð誳¡iD£ñÎô I<ø>¡ÆuÙ8û¸ .°Ì3IØ7%.F»^³$DÙi) R¨(&êÁÆÔ©Uá¨6û8»gÑäÎ%(ûñÇ(vº ¦Z]xçð I¯5¿¹xéãMÒà ½nç ³gî}Mý2#ÓÀ;ºÕà ` K FÄ{x.ªTç Hûüw[ÉõÁA,LÙIðÇñ1Ø<¯ÎT¸Ò#^¿Î*ªlr*WË-?#´æ;:¸4 8ÃfQXO O¼WÓ°¹?½L`"%`8+âßY-Ôìår>F aÎBJÝuÄÁ® èl÷þÕ¨µ þ&H¤äjº`Ûûñí`¨`y MñX-ãõÏbÿ » !¡AÀ¨aÆä\"Ò1À2tññõ9$¯IÁ ß6\J IýÆzL-¤4ë ðµ®B:gX Bð=sý÷GéV¥.Î>q¢ìÅ>áÖÓCåÖöªÖ÷ û]¯É¼@¥ÀÆA;®`U] Û Ydß!D!eàâ.¿ùGCõþk=xÎ 5rAü bòõ ÇÔ$Êä ª9kr¨çoßùÊÎOyð[Þ"X¯üï¼tc©ÕtøçÕQ¬\^XÓ°Û ³¿¶)ÊPý& ±F©ïÃüà^ÜMtʳgǨ6¯Ýûäm'gå5E<TF ÉS-àì Zðý1ëpÃúùÃ¥×ú8Á =lä¶.ÝðhØxÀÈÑ'¬}!7¬1%z®äSæ¼l+â*¼Â ¶Dqµµð8ã¶`mGef¢l"'©®NúpØÃÉámà§aåØâ¡üfò¨n´³n_çxÑL4 × è )?ÏG ¯/è}¿,\ 1dÎYBz9>R¯6çgõÄáhln pßE^Z»: N¿''yÍèó6Öâ7÷1Ã`'NÃÛôÄÕJá¾þ¿¦H ^×7çIï (6 \²ÝÒ+Á~ cB]]Ý Ó¦¢x1p*µ;aè8 måØý.ÀBñG7ÇR'Y i˽»À(G?Ö*ÃÔg,ªâõ§¼Á ©×ÆYÒ8|:ÍA¨¶Y/`¡ ¶þN 5 H¯Z0ÂT<¦ò"/ Aê;C¡Ò {ûúÁ"`5CÎirzæ öÌ£SFÏ~Æ é $'ÑÏvñÂyuña°k þ¦ ê¢ÉÓGýçÖi+i»÷ò~ÙÖí À(Àd¿oü0 3Iáðñª¡«¢;Ou¹ _F¸ºÞøÁK'-^8¯+ÿ Ièrøç¼ìPÙk>Çÿ Íä¦b l ìY_Èÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 19219 |
| Response Body - size: 19,219 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ¾¡ñ¢j4ëÝ1«j(: "N HN ZZ2íVöû·£Æ£*$ ,A£e¯Ë$«s4°óÛJno¥ËiªH*è wÇ7¼ÏÅÜÆXî}Î7©Û Å5[9ÕkyÝÍnæDèÓL¨ÚH2²r>¿>¥íݼÍv $V®á¨:¢ `NËGRªoDíS¤=}×DâÖÈ0r"HR·^ºâjå±c½ÔÆa`ï$Øm K5ÍísyÞ¿¾½ü;$ ¬´§Ø9Æ2Õ©gpâ v ×6v·?¯¹Í}ì{¹ïªúP0U§^,ÜõÞ\÷ß+qÆäXºãµÛ ÐCs#AÊ~¸ANÄfNååô¢±ÇÝ˪µ¯WÈÎ]¡Bék/*U'c«r*ëË/AQköiçÓWÒ,+jV½G|uq²¢v`g÷äÏça\Ê¿èTw¼¢$U²Ñ`ïTÀÎoHçÓz WÃfÛ·J7þcMغri H"¶tcãå Ñ×Hj]=òó7qi¥«Òù_EæÓö5 e6?©cmpXP·wÑ,ôq£Ï è_Z·sù¼ ´xÒE¥2wÛ9º úôtdëzÎÅ4«öD' lèÐål´PK1æ¨ ]l³Üù¦zÎe"äì<߯½ü¯cFÛ :VÖøg×>[ú4 nã´ÍWô:8Üí,të·UÑÏy×X¶ÉÊÄzF³¯kIÑ£yfS¹6ÊJN¥[F§oO/I1«Võji¹è\GmçØZÌØâ ÒÄR{Ï ¶ØB*¤S3B ºÎjÿ qB÷Ë®êfj2OnXe 4í$ÕÖ |ic¶8åoF¤Í ±WX` ȼô±*9jÖ¡íy/\þÓêà Þm£wô*º%κjuoæ}Íîc§@ãImq o'C9À6g[nÚ¾dc{TÅЪ¹µ]Lm9qõÞbÙ[ ^vÛhXÏi X;Úi.` -R¹G ÷¹GÁRsû¯?ìÂÛZ&UË´8ÍÌcñ¯-HÞ-Ò V×;Wcç[rÜ_¡pûÒK0_z¢ÔÕ¦-}+¾ùJƶq4 ;?B¨¦¬ØÓ.µ$\P£®±£BSÂl2VÀ½Ìk©cë>QèjÉ[ïçÇïF¶µåÌîXªmbôÖ3ï3Ôù8jÇÏEÖ'T´ô ÖiÈ`7 BÆ6µ>Mò°â°> é^kËè6ѳᤫYÚý Ïï0à궻Q-C¡nH_Ç]÷Ï=)mÈí®bÛ h<ÙÒÇhVÍLÐøt ü Ü U }´l@¶qÔ §t?¹Ð'r|X1´è ]|² p3ºð ú{ D2¿=ÄyåÊÂÿÄ * !0 "1#$2@CPÿÚ ü.ê¿ùëãÃw~@[PZ7vï÷áÜmZ[ZYYWÛq>7bi_ATßÕs-Ê%ZüçÝÑUnØünÑC«°,oãsZ·U¯ºå¥ }¤UQ¬ù-shD~ï¨ÛC /ãs´ßãq¢4=t¬RaJû®ãíƯ údÙ½~güu@6¯"®{:¹¿Ç$ÿ Oíc`¯½ð²µåãtQÑææᶪæý.ÈëØ9æÛ Ö ²» Âêf×î.¥OsPT [F#Î÷ôäÔ$/ãÆ ÎõPÝÖü _²Ù¸Më(·.á G TÀ: ÎOåÉ~´AÔöë«hP°Jº-Õ72/¾F2 CôÜeV;ù,¶±Jc÷÷»¾ÎQZ_µVS¹ §¦Æóò¸êGF´ò¨ ØWÊ/®êXÂHÝt]hrrâÈËãÉw²<2)½áÜahxFU 1ü¥Õ×æƱìÅ̼Kð3Bq?õû.\hQQmu.7?òl/nBkunÀNÀ´ ggXÿ Fÿ ;5 ¨×]óÀC;¥\kèÝ o¯Ñrý. eÕ³ ئâYò<gºg( þÞêw(V'$h÷pÓ V AòV÷.á\it;ÊdÒò Zê6ZÐCâ¿+ô¿K ãvÆÆã8ñßÇg·± Å`¨Qþ&ê:¼Æÿ TÊ3¤z¸ª f ûF^ÄÜÛ6³öã1®åÄE`Æ2ÛK^/Ä_Múñ¿! lèüWUañ˸¼ÜF}Q-ðÙFóu ðð°lßΪæý·Z*1eåâ4?# ÇM³jÌc(_mjî ¯ªåÆÆ©£Z¹¨¯*òhbïÆÂþàd+b´Ø]vw·³¿KUq OÝËdØñy&ì|± òd*Öò[ò¼M!(*ôÜÜÜíøoÒåË.£tkÜë |vãq18am£!ÌGÅ¢ô¸pÆ£>'kbr ª»TPÐÕzoÔ®-¶· ÕÍþ7.(P¥Ïç@Ì6qêN&Md=|rµÙ®2ñ¦ÎËspÙ«ï¸Ã¦8o?nm=?&²)£v+ð"Õ @õ_î¼[¯MÍú_¥Â.Ë: rÊú¬\QYr¥íä¢ø¢s+ælàâ9ÜÐÀ§ r~é ÀÇY1abÆöÆ¢øÂeÓòyËJ¹¹¹¹¹¹¸W< cßp®Y N¹Ç!êÄ`²®©¦Ó,ÙþtÚ³´í 0j/0ñYÁ5Íkk<Í,H_°Ô^ù^]£æ ʹ¹¸ÒýDî¯sp¦=wuyÉMð3i7#É´.AÝ»8 ¬ LMÙ@²»6PÎc òo§y¼¦-Vp V±ø\9úÓ}([[¶ÐÐëq¿Æ³³¼ÕCÛrî ôݧ;!FlA6 ÂË#|¥B4æ_ëkäÐ}³±}ªðnwý·Á õÁÌGc4ãk1]£È¿íJr¯Öî\`ÑKXy±-m- ]Ê?¬[-×iw *«Ê^Awø¾'(ʲ²O®&u ÷"Ì 33 XüxO(T3ÿ BúYpøñräZ²d*æçiGóëráÁÉjesøìp2få~æfä3 ¯ä1ëôSwrîXyÅâ0 4µß·N?ºgüÎe?'²V.e¹jÑ @¢áÇCí°²!¸»ÝÕÍÍPãõESsrå¸"Ò. Ìò¥,ËÊw{s\7ujȧës:ïÒæN1ë Nªÿ ^i933*Ünwxw¾8üP~fy§?Îì%Ë]îGÄ¥ãb`[ró«P âPÖå|ÜÜÜ»DÂòn°ñ]ËɬXÕùPî2ÆÆøR¿6^H¬2ÈÝÁ+âX.ãEy9*,á¬Ó t ä±Øöåcx©UUOÿÄ + !1" A02QBqÁñÿÚ ?¹s(_ú/érþ£³S.ÆŨÈWÏìȵbo`LUóö=0dsÄz /Ý}=̺Çù ú_}ÏJT6È;s6Goûñ 'å=/ÚºO3{Vù åJ1ôft;|JSô»üN?_MÊûuæfÕÉÈüaBÀ.W£ö éì0lg¨`£paf4&¾oMåÆ YjÀÆC 3g ãø¨»,fnjõ55\?!3räyùûQ¨ÄßR¼2¦ Ц¸Å\ ìy¤#!iXãj3]®CÄ°E´¬|ýî¨~Bæ®×º8¼ÛÈØW¡Bç©cß`cb¦ÄÔfg¸Ç¸ÚÀÜÇQÉ2?D[3>¯²@úÇ/3K^¸ÍÜMdÀÚj[ó3æ|¿Ìý¢ká9MLÇüüCµuQ2|. &` ¹Â±z°^âøW§ BìC7°Ù¶n¦E£*T©PD5?U »ðãÅb½õ1õæPêRsiÆ&6æº7ÇBl¹3??òTÇ ÄÚÔãd2¥A,@f*±%õ?°fÆ·% ±QqàÂb \Db îläöÇBfØg^&*zv?ºÜcá8Í«=P2ÌXY!@@¨O7s5þ#kün¦,Có0 ©þf|àÆÕËí5Á®¹ûeÔ( ÌjQ® q±ó YÙz Jó¹K±k Ö¡"ª{?Çêd¶±uæl\¥EYt'¶ äg³Os ª¯S:ÛOjùx¬$(îsùBHz Ï Ìñö Ì£õ*fcU ¹SUC5©ù©ü4 âÿ ßýL±¾æ^§ÿÄ 1 !1 "Að2¡0Qq#a±ÁÑñÿÚ ?ìÝæÛú5Ø C@Aý+q¤µ®@Çô5ûUrûGÊñà=8h|ãÃñÀmsÁT<£ÆÙñ.óf[éüÍ3«/qànD¤(müs;ñÆ=f{uµ±Ç¤KÓ¸g ±;å(ÐÞl Ä.-³jäNðct̷̸馸!éé4öóà¾é¶iun5¼ÔÞ0bc _ £!ûÊÎ ¿G¼}F7Í Ê·#óµ @ UÂÅÜ%õ°ÎÃÍmÚç¥(Ájèf«HïN14-Ä^íÉ E°7O F Ô q^ó*%ÎÜmÆfË u¬r{IUÂÑm¾OI®pWvéðÇDMÂ%é«;z]I_Ò<VÙ°f[xuþäÄÑ`Üæ_¥ÍÀt·VÅenúbWøÌ:öªcPËËþa·Wõ,6¾;¦÷ïíIfÓ´ñ47¾Uæ)ñ4õ©È Û5` Íc ð2eM½¿oÏù1Ú¿y\t:*õ ·f¥¬bW·ÒÆp%îPzx 1¸1>S5:]°ncm ùûM6¯k8ù ËQ·nS5fÕnôµ±+ÔMfß1o´® Fܽ÷Åg¤MÌ&%ÆåÁyU¥Öþ²C+²Øf¯vyäF^ïnà >GÝnäÅÔùöæZçÒk/ry@p¿Lªµê º»ÕÛ,Ô>7%zì@ôæ1ò¸¬ý °ejç$MF¼o/úDn _còG÷ ½}ÿ 0é =ÿ Ü èûg ÿ ò.¸ )Nõ÷ïß¿Þ ©jÒ¾²«7®faFx55-ÜpfµígÆfá99ò\¬²á§¨ å ÄªÔ Ùûû1é&¬ ° S0PþÓûO¬ØÜEþ ¢ôGïlbÞ2-ëÍ[¨²úMe¬µfiýæb²Á¹ÿ ãóQ5CÈL¼#øÿ sHæÛ¶·¨;6ÉIÝÖÿÄ : !1"AQa 02q#¡ðBR±Á@rÑáñ3b$4PÿÚ ?îgÿ ëü± Ü9ÿ !¾`°¶ð¼A(t[6úåfûNÞº8+"<rKAVQp§/3¤«ñüüǧ0Fº *#yÖó?]#ùvÂcí÷,2éåÅXǶ9µ ÓÀ![x/Üx2Dg ï|½¦ `ê¯=FOª§hUg=µS duãôQøxx&ÝU{ Îë]¡û?^¾åôÂ%¢×îN3 ¢ÀZzøäΤ ã2:î;:ürF>¿ºc ölîØ7LdXÛgbV§ ðë83ßph¹ÜÚÿ vâòÞþ¢ËK}c/ºé3û.ùT·NãG3 æÜÙ pÙ{*ù5À~?E³°RÉÝ º¸yf5âëÞwâ¿Ðj*ÝwËLÂP' 'i>ëd'Z÷JmRØâ¡ûÌkþÔ¢Ê ÜùÂ=0¸÷2ù~±0Þ^1Ð Àò÷7SË Ï!PÕÌóçöMÉ -Õ 3ØÖ Êb0·|<£h ÃT6Ö7-áõXǯU6´W¼µÀÛ¿lÊ5(Ú]ºiçÉV©RÁ³Þß;¾ÛC¦8ýxê±ks¯ß>×κ´ýýá L@^NJ Û2°÷þ¢sA9#4hìäg<|âV9Ôj7%墻¢##$¨q®ÍÃ0wÇ1âÁì<6Ó{[Ã@ìôûÕÕ¦+RÌSkU?á©»!ÆO *±m;«ÜÐ1)®$Hok ôU¦¥B&÷ÕS}£8'6« 8Z±§àZ'S\Àn÷ ãÕMÒw´}B.×â¶ÞÐò×4\Ú|_ÑS¡¾fòÉáÏD1 9(v$i"Usí/$Í2*bÚntV:ãXê=U9\.2{ }íaë¢eJmptúª´j=Ì:OÁ$uð¹ .·þÅ2HFpGtì:O)RÙ3'_Íxth }P}7Ò ßºg]U:t8cDj±íHTÍP÷Õk-§¿Úz({EìqÆ?Òx£L[¤Ýõì.c ZÀw$è¢{KmTÁ¬ËðD3¦h{vÏr¨ó+ÏJw`àã¶LrñìoÏ¢-ö}÷?ÌíAôÞæÙ?t¸\5ZÇ#!°»{¤KOÍRo¼==ëU.Æîºÿ nÊ Ú%²3ǹ¼D&ºñ$ #°D6ìº[y~«hÀE¹ÔÚÖâ]® ¶Q°ó \ê¾ÚP 5 ¿U _{væSJ`T8x8Þ 0·xàölhCoÖ5+kE̵°ÙcÕIt¥=¯uØ»° îH²Î¡æ9OÍnd N»tsÓ¹ö $ Â-ÿõSB¥7ùµÿ Aî¼3£Q÷ú*Û>ß3%§yløLªsKörw±õ ïö'7Ú+]Ã:'Ôtß? Æ©»çt!q.}¬{XíÒåúöØ èRÛ÷Q Ó àâây¼ҵÜÓÉ´¸âÓÝʪ:ÍM:ü¿T0좶³ýéòܶÅÎyÑÃ%¥ìÏ e>£% ÉcôTöu)Ó:<ê9 qRÂtà2·Ìäa $Ï´NpÚ:ñÇDú;XQ1(¹Õ=ÿ D Õ6«ÉÃV¿õM§\[v¼¥lö6È ¨Ã`.}¡ó -|QuÑÿ ]T¼ÿ ãÏü£"ô÷LDáÐu_ûFÆ*@wÅH$pRpÞóîüb8fZòbõ ÝÞØçÃã趮¨ëGáhm¹ß ÇdHïºDÂuzÛ´F ¿OÆ © 5²mä¬è ÞýUùêîvàÊpi qåàxjÖ`nkhÖ Âp8½®ÍÛ[wµ ÒÚXAÌˬÀHÎRe[êió⦤ÖCÌü¹)3¦æ±.Ü> TmSå6·ÓónæÏhi0u mZ.¹üGÜ¢$:(g¬ÆfZ2YS}Íäc+òõäe¯.Çt÷FØ.ø&3ÈGrÅï4fìôN/¹×béÑ ó*lªóc ôMö¡å©Ãy ðï [fª c 2³éÊkè{¦w6˧öãÁlÜÇ 24Ò3$ykLÁÈÆ«dlk@Ъ+X qSl¦ÊµÌlãEL ÎØ5 Nó©º A¬Qu ®ØZ^Áu§"e²-'ª}IÂæ»GZuùGZì6 µÏåþ4PüªÕIí:|B©Q²iÌóTö hB$º_ùÿ ÍS÷Îóʤʣx¶A-á÷)ΧçäÚh$ñM± z'C`©NkHoÁ7½SX*4æ9&lMÃ%Î 8D Öá1æÜ7xö[¨ÔOÏtÐûaÏn0kxÚàÞ ¾ÑRô5ë¢÷ta Ù3× àt¸j²ÌCZmpý¾©îÖÓç|4BTÆ?ç¨_ÄÕ4 Á¹!ËX ÏsÞÒsú¹ÙÌ«º \Zà?äåþ>H8¹» @Ô¢Ò 7 "ÓæiÝ(2Ð<õV¼gΫF¨Þ ªQ£AÆóù ºèíKG4Ê©¾5# 4Ï~ÆÄcªÙ¸ËGôqïÓÜCë£ÚÚpdÀþ^¥O+i7#Áj2y Û^ÀDÜ[Ð}¬DGßúVµ oq=;0'µ¬Ù1%KÚßépÊ-"3¢ àúx¿/dá>ÖÓ/Éûê³- ÍçSþ&ç541 ¦myð4BCf7ã#æª2Ïví øpûÑC[å7 þ\Â$ "ÚNàS:ÑÖ; gµÅ¢mê:YJ«qaÕÇpÜÞ}ÿ sIÏ?ÑwÞ¨ ¯u @ Ñ@T.uÎR«)0F9rìWNû=óð-'Oì®ã~]Ýß $F§öçØö¼eÞSÈÊkZt<Ó`Eã «:ýåSÖé$e]§ªb,ëQÛ±Ë=4T¨û5+0^x©eGT`?1Ñ n$Ô3÷Õ=u73_kç L yõp2£ØÁ¹ÎѪêθöÆo¼Á/CÍoeLgºXþHøËèþ ÝTÅw<qj© ËÓ2^N¿sC't¢ D4È í²Ýâ¥ÇúöKL±}&þ1?Ùp¸+]]òÂ,tÂk;1¬è7äpÞ?D ÏÿÄ ) ! 1AQaq¡ð ±ÁÑá0ñ@ÿÚ ?!ýJWÿ À±ú§þ+ú !$IãªßÍý?÷g% ýÌbBIB#vÊà¨p×ûì`þ¹ôUÇôØÅ´»ßý~ø:¶Â2w®WÇáÿ WÐÒcÙ ¤9 ޣˬ¤,F¿ÝoX§'ôO¨2Àääú¬þ Tâ 2-'ÈK&sÌÍÎBÿ g\Xp`s& !£nökyk~⥲O |¦ qX?®KRMÈç4C;ú¾¦NõqcôO"\cdöb ]®R×Î@¨!îsÇÓ56ÁQ_õq P]a+Bt<½ uÖ|[Ô/Î@ÎÊ:×ô}1V999>Ä+;`&j|*+8÷äf$¿P+¸ö¶÷Æ2ÏCÝÏOa2HÓÐÑË>äXĽl,3³ Q rÈ£ !dÚÙíh | $ÉÉÇYh`¿ißO>Äj21CDÚ-PMÆ,=ÑɨÚKúDÿ <û¿C"s$ P6{íO,ù>H£x|=}7Éá!ÜuW8tô8P¶_W}d¾ ïðÎD?eO¹ûb$«åX{'N.iÒðà09 EÚþíÁ¡ÃxÁ¦a@ 5¿ãM&*|üa ,nQ # `%ýqI,ë':L[xÊÈ}zràãwÅÜmý°Ð)Xú 8¡ûå*]{Yñ.ÁÆ Ý-Á9'7 ¡H×M óÿ ¸Dv~!¥àýðp+o'] q;5VÑcH¢'l ã~Bº$r¶å ¡Ç ã# 1°Ô ªÒu>s&(ZMILVÂ¥S×¾kEÚ·Ùã#gv¸zO¤ú¸ë)Ò2K4§ w'¹. ~Gì0½§No¢ÌØé0¾Q8I êê(ær½Ü4hI ¾øÁF@+q#öɾ[mÉóíQ4CQ ,8£8³¹)5ÈöiÂàÔËÖôÍy òQ'h19 Ê ¼@ßõ #-{!Ç_à?¡Ç ç ÜK]vÜUQ×ð C)Ûmßq8VRoçóíz+(ÜöÄNËÃZ²¾?פÄ7Ä#< 0±DºÏe§ô¼*·µp¯El<u;Âölà"7ô®å8$ ÷ ÁqËÙq°\vÇÍOÂG"}Y»áÙñK§ÓËs¨q¹¼·ÞDÅ Éôÿ %2YRý?K(PNrС|ÁÆ[¹ÑkunSTh¡÷DsI@ WFvdõI¦ ¶Þ3áë'''''Õôwð`Ál³-HÄbA)¾rgCNËu¨ ºxxë ³`ó¼¤ lFýÄøÖNÞCðNKVf¥Ñmd .gÇ/ û´×ÆB@± ü¼Ïé''Òcøe}îÚ²üå\ó1ÛQrÿ u?é¯%(KÖ F(JÜK^ ÂÐ øic¬× 9Mà^¦"xb!4 $øó£ÚÆfÓJuægÄ`)«ÝfòÑ]ù2·¾ø U¬¹Q$ûßÑÀÔtBsq"K¸-måç$QßOéÆfÀ7/ ùߤúM Á8(]ú*pf Û5çÏïã 2I9(?5#2¡'Ó³ÛPáÙäåyÁ$ÞJ©IHE¶Y5ö?r¦ûÑ E`ëÒrrKOM1G¦ PíI\çãqñ-Ln,ª¯¬îì(Ýç§ör&JV.gý÷[\vÍl§Å¯8Bª ηõÃ]µ¹0&FpG¿ìÇ!ËÛ©K ÈÄès»GíÖNNN&ªðÂaJ¸¹ºñÉ]áöÁ@} d2;©¸é 8Ù EíßX(DÜW:M?t_÷ ]í]OJ{ p©7cE]Ö¾3iúWÕc¬qÄZ¸cÄÏà\ ×> }ñMߥî?°}²@¤9,üý² FZ4Ûܾ+¬Ù¦®0X½503@ò·?ù6´òR¶>ºûä9¡TÓÜÎdItfBã(BÏ¿{rsиQ 0 ݧ¸ß¨©\@@`8¥rs|s ñppÚm× ¸ Z ù«'x»ÔÓ|óªY<ýqAä<è>´s #VÓÒ>xÈEPñ0HXgGµbÖ/YÉõ_EéH Nq&3¯$°ñÍ)âzñxÂ"äBç&<I{òà0r)ääË@f .¶þìÏüdKS$]ßËÇH''Çäb²¯g½Ä÷Äk¡g @rex KØòÀºu0ªäÿ 6ºÚ[ ÍorëßÙÊS7Ö%ß».O¾þù4öâá©üÖ Hi,B`¼Z?yâãxóbÔqnCÓÓHÁÆAíòLè 1sü¸F D Ð01Gbqãüǧ5£ãó47%àÉ¥ ij1&þ"2¢¦59nqqå¥áta&&¯ qU%A½i¨-úd Ë?À_Ê(¬4Cqro;Øã®ÃÆ2fú`q°ô)èø2±D,d²}ôß5Í3O@Þk&Ø%x3]6G<·SoSÎ2×°^ÑκÅ8 8ì§ØRs÷ÔoyDkÏ?lè¿ /£zrtx<2æªÏßøÄ2!Ð èøû̹va§Ùóç$ r":EÅ}'â²"5¹(3¨2 Ü{Í`Kcx f3ë6G8Ço ¼á©^£R(|VMFDÙ»Ö^¢Î(÷ô~.+ÍÍ&9Ý Úª·ë \{~?muIÁÁÎûÇÇë¹ëµñßv ¢_Û>¾ç9_¢nQ{8@,¢ªwßOÆAX«qQól ÕM?\nÌ_:æzþt -W÷.KvK}Á'«!ímAæp ËQäùq 4&ÏÎ?I}*ÆP7XO¿ ¼R \hõ0Çã 0ȼ` @±1¶ãë^S¼8ñcÍý{©h=8(P §ÃÉP8<°ÁÖÀ7¸ãëXÐ0lK ` Üÿ 9Kɨ`Ä,*¢KX7 {8âtÂN½A4íPú reÂN\ůd^7±H ¿Ó **3øáHS_äè$S I=²II·õºàÆK Ù1°äë RÚ=ÉMü1Õ JÎÿ =bôȵÞmf ~çr|9~q*É ÓB&L)ÔൠMÕdú$ìõ߶ ¤Òûc& ÈKs~\VttÅÄñÖóð$ ¯Ä]b»øT=ò)µÁ;Ö6O$q Áã_CtL}øÍ9 OÔ ¯-¾,*Ö FØ®Û}òh$@ûë)SYÇÖ~¹4OH}Èt@z\80à&)ÇN8¼¾uî´Í Laõ$#íÎL299Ç-bJ\UÛMª¶V¤wÞñ´ÉUéJlRG '8?{U|>Ùp³ùÀ¼ÃgØÄdJPcoûÖR"÷¹Åæûgqªq|´\>0U'aÆÞ9-Û'ôÄD æÛðòã@Ðv7 ²Màݶoóò¯àOx2 Ã+ý§ù^|b½µÖ~?ßlµgØpÑ|ÖJhÙ&È÷?ÑÂ0 yf¸ë$÷ÎÏ^×5ç DWÆ!Ï p5íò©ÉE=ß)³ÚxÁÐåX ¦$ÄæzÈá[r½U»ÍôS Ûõd&mO³æ~5s$µÙ.ñåvQ,xbj!åöÛ¤äfzUÙ¹4÷);ç;kÈÂa*|¾Às 5ÒPÑÖ%¡$Ø×F·IÆwFh|t{¹ Ç{·ôÄdOÂ|aSQu_¹:Ö!Õîo ¯ îç÷ OHÌrË`õêç7ÈTr 1¢! lxn@z {{9ÎJcËl/jGñ6v³ Шykç7(íÉàR'-ðª;l~%Ï 2ädY/8³¸4`=ðÃÀóu ¬\ì:ºâðiËÜu¾p+i;ñXÌü"! ½±â/´æw! ùÎ,¨bâ>l,Fìd»EW¹§nÖ'QóçÇ/$X\§ Pò÷õËÒ /× ÄT,¾Ï4ôm6Þ(äÀÒdiUîc) ÿ !rX§cô§v(<ÔG©Qu0]G¼± åF)YüXÐhD v×͹ï××êJþó`«'Ù;KÖH¥(uÛíJÐ]Sq{:sÎ ¬cH_ÒqQ#¬ò#ÉøelêÝüápRØB.§,»ìêâïa>Iþre6®sÛƽ³3U¹ùÞ*M¾ ~ÙÜâ"<¨wç! )ÄSÇõXlè*+ãX Ä@©.8z×0¨µE½ 2ÿ F©é·Iîc)+l éQ¼3 {VgãsîÆ¡+*J¸<<Er Eµ~ÿ ;& JeÅóá¬,"u&§ÌÎHË×(Rý¿b³Ê´9ãZ¯0Kf@ # û;ë/õÔ `¿ÅÓ¹ïÑ/]3ÝÀ ûþX'äaø~qeòpj¡9¤£Ç¶"á¥. oQ>ÛÀAJÍ8XÆpø'yH§'3ÿÚ É ë=¯ú?wÿ ÿ ÍÅûïÿ ÿ 2ÿ Ïþèýïã Óp¢rÀ£Ö<Òþr+ªÙÓ£ø$Á$¾½ðAíkQb Ìü:Ù*+×ßÚ®ðZt»º¤Z'9þÀ¨³UmwâQÄ4L¢Oúyp5ͲsKó_Yßo<»WÞ| :BF\þ,}+Hg=ÎZ¢öl5?ÜtP¿¥{ÍBìSɯh â8þýп~(öò/ÜÿÄ ' !1AQaqð¡±ÁÑñ áÿÚ ?i 4@ùé^ÒY)âZ¼NgÓ¯Hî.\¿ ¶²¬{ÌɾÓÎø_nê>8\(U pÛL{ÜIR D+AÒaà-ÀK©Êááztáëùã ýó.\¿7G `7 \¦:ñ;é7prÛ|(j\¸7¢¯sZ l@öé}eȱ Ûyúë ª uë-DTÍÉà` èo^oÊ [W= %IÌ-oͬ{Án4¨S \j¨k¿hÀY5u̸ÆC¬¼¯^¼¯hu m߯Ä((ë³ïrÆ·ëþÝÜ+çëç[qõãÏð8éZc<¹Lߨäã[p©¿]¾ù,Ç&Ý÷ôÍÒ_xQ^Þ*ç¯ßÆÒ2ÀW³ß9^àpBRL¸_6 kÁËßÖt#¾øGXk-o}+5þ&<J"\n(¬G¦¢ôå¤GÞ;ö÷Ô.¼âDA($:¡.F4±¥è9ï×¼Ê6V» `õçÄ!:Ýs¯ºøbÔ©VAMíûçå(׻㱮x_~¹&¼_®ñ±¬Ñ6sÐë¹o È@Þ36I%âæ eÑ¿ÜÊ¡W^_ õêô8ÿ Ía"&¯®1tïµKp1 Wä9ðdEF dö¾÷é;ø ¤u2LZbIn®:c]¯Ki¼' Ê{@ÜmZé¯íCß{ôGEÀ翬Ï/£wëÞ+Õù·àSä¥`ÎûÌÚk {ü3ÞÑ@µòîúKEÄªÚ ,]IÊéÿ aª_}±*ÞÁÒ-²¢ Ëpâa+1iM [ñ¦<ê"Ãô|:úó&¡å¯}ó²Cê 'ïRÈù?+»«¾ÿ ]2yµ¡Ý@ÄÛ·¿}eÙ ÎÒþ Ö 5 1en ÁP jÅ d ïïÝy2´+ó©§ µÑ¤¤ E[LüG\Öd¸ùFýe.ÖÊA¥¯F À¿Ù kóö عâ%|ÌÖÆ,CÌçÁÿ ¾ÿ ²¥\Ö ³ÿÄ ( ! 1AQaq¡ ±ÁÑðáñ0ÿÚ ?m ûÿ D8©áßÜç C¥|A ¦cßlè ïßEtÈúQàëW±ºóç¾æ ÈÚ½j®ýÞµàÑ;c£ >y8¾¢ 80µ1ü½5dÈ,L 1H2ä#E;п ð¬ï÷õÁÉÉÀÁ1Vf8Y%:i]GLz£úî[ÀÁ*ïÝbtâ7®ø$Å â .<Õf ã®øîN! y¼út®ød¨öøÿ 0[«s°(rX7 K=«& 3EM{äx$âá]úuiã"I®30tt9Ú~2¿ßIpfÉ<öô#¡=qYfnµ¨Ô]»««¹H¸µô/qXÐ=& ¾zõÙæ°Gy<GÇK¼à§PÉ W¤Ø»? ¼Õ Vfôòó ãË Æ7Å»¿JÂéÆÑÌ}&q£ 1ÇNÕ«D`ªÔ§XêÕå MÈby§¤ÎAk'O×÷³b^;ÓK57£]\7QÞ²q¢p8SÚ³¶+zuítÄ s®' Aòtí>W4K ÁMî&«¤ó¸Áú Âù öÈÈ::ßùx}î/>½±á@êÙ:iZ7[8 ²Ôíò®Ç è@2 x9¾W)ô²½j¼1c|ÆþÐóSß- +ªòzÄöï8è300s'úì Of?º]d"1²"µ´'_ Âr| ãåÖKG-V$æà&Á-×N4§¾NLTäû'ιÝ+ï¯OOVVd£ óûÎ$)¢zÅvfßr°Ä¬ßÌ3Ïç;ûà \½ñoæ<Ïc¬ääâø ÈNHù ¾æH$4ÍûÓØy`Ú£Òå Í6Ê\ÓÀ éæ>1£¦b:þL (ÑdQØë}¤QK)éÇ %ÞA×Hiîå§Ê'ÛÛ\àø4 ^zåY£DaIÁé#b «8®~ËFXzó §)@L]ÄÍÖïú±+ ÕÌ?<ãÖi7+ cÁ ÂÛÕIMîcú0 >ïô~p`ëÉI8²ý=>w$Ô-#|Ô×¾#OlX8¸lýðú{`^¨qùøónäÎ!ø8¸5"L½ üþ£(G#pÑ Q|K¸Þ, ÊðIg£X>áWÌsCÓÚÂ"ª¥ °eÈÿ O#SÁ,¢µô¤Ä9ýDõax«v~zÔÇ粯°DX÷ô Á× çaOÊÈ]ND-F¢ý4möM¤jgüÁq@µa~ã¾8Å2G\Eýýøä®õ³ÜÈ÷H) h[êfñF´x m Ø#O;ߧ£¡y+a¼ÚÊÍþ£ ¦ýg@Ç÷_îq àíoùìd£'RßN>Ð öÇf={áJ.*·×¯8°d{Ïèòâ°$Ô"« ê¦0A £f ¬¡eÞ¦ü²IR¬æ}5X 4/÷Î8{ÿÄ ' !1AQaq ¡0±ÑÁáðÿÚ ?ü_ÅIJ`~Õï Ëþ Ü4 ûùþÇáùY µü[GðXÆ° 7¿Öh°âti`@ØíÃr¹råËþKqæ#&; ûÌC§>É hiYîH ×þ9¹7{@7M µOPiüØŸý~~ P_Ë¢½pT1ÝÅ53Äùë¸q©F®Ð ûàØù øþ:ÃháT¦ Þ|þñUbg VÒz²`Ä*Îj¾(:EG0ùeüS¸³¹¼´gy#÷÷ÄÅ^¿5ÏÊÜX.¸ ³dé X¨')WGX©SYTaÌÿ § 4§².ß91"on"]ÁX£4Øá £S@ôA¨6BÚ«Qvû<Ïø¬î-pDv+Øä±Bà(- ¸ xLè` ÷ãð· `)$Ð +:¾ï¨cFÀ¬ v ì·fCñ èêê¤JÊ( ½ à@çµê¸?åËø.-bãW¸½ÃPlNY\©sÙÃÎl+Ô¢L(àÆõYF> 'OT¸#óó÷5C¯àJ- ïD¯¼hý°Di ݱT >° _ïÊe<IõËù\V"= *D°VDoxle×jÝÌ´ÁHátßY }7\ÿ ~ñÏÅÿ ~? ó/RüÄ;q /ÑÁàNi9´îAêB4Ý$¿ ¡Õc & ¥ KÏ5Sév}Ø[Ícl ?£c-ÊD ð @P½l©2 ¡×@RUÍõÔÒS¨ ;«xÀS¿ÙMëûü/ã{ÔYX/ÕÁL¢]ù& m éÙ_ùø ,§ÎSçï.\¹* ¬SÃRÙ éZ k z>Õ l ~\nà=Âõý`=0C_ï4P P R7×ÿ ¼Dsôõo,' ¹Ì¾(GE .Øw}C F*«]qm,DÝÚÔPxá Zîu!ùÅYÃT_UåJ¢QhÞµEÁ ) 6b¨¦º:dpæ~¢¾ol1 «jlÏÓ5r¿¢ûÍôªÔºz]|O>_Åf-|( d{ RÇúTKÎ " Í¡Õ**bÒÝYý?éÉ´ z ª@ ¬à×ZÃT Þà.I jº*´ ID\Ø£¥ ýa6Ô=GÀU| ÁÑÍ{Mxc,ûñS*o×x4ÙkÒÜFËÓÀJ6éZjÛUÅ#è´@l¢}þVçÆ>Ñ\³ ¡ÿ ç{2PØM÷Ì*·erÒlJ¨íÔµÝ'Ïôäàt¥¡x[EÔalÇÒ_ÈWçÁ §Î#þ³¦\PÞÿ ÍÆ# @[ [fï°P*¨o"&FKµÒÛM »ÍúÕBé! ,¬=JSd%Ò°²Á! TòFÈŧ 7°¼RAFMhÀtOéÃÖPãvN ¢ÂE du k(¶,EHâpây}ÝÀdâÇáºÄ õù` ßrâßÃó8ì~Å1©ðMÿ GÆUÌY1} `pcyÆÜØ úTïZHB6»0qm@T ªúÕwAv<ÅL>_Åf-üÄà#îR?Y,Q«´w+¸ÑSÌ jÛ×ʺ4E^P:1C3ÅKbèÚÔwûXT$`*á±,dà¬IG!Ð]: ¡¥)Þ#3ÿ 0JYEoh¼nvp ª©°·ÖSzl=²VÛ* n¦ZÈ e Nã/\©èx¡c<¯íü¬ü-ãÔÄEÏÒÂJ$!vtM ¨då:6È(H *ÖRÂV½I©ÙbÃeÔ¥ÆFô§BKWȹH;¨Þ_£5þ3ïÞ <>~úb¿/ÏÇOÞôÉ:4á 9î%Í õ>å/Áê @@ C#TE,n C»Á%Â|QPW"`O³L¨CèR)R¯U+ ÁH RzÃ9ì$V a\ªÉóì!TRÀ,}5U½"SÍÅè:vORЦB! Q½öïþòå~Ãg£ Þ ½Ä%®Þ°¨!B¦ÕFéf/G!»>¬TBl¼-~LÕ>L P ôÑX¿1DP `Y°lÉ1c@_P¬ýW)üÅ®:?×Æ ó§ëÞAMæÏ aÒé³GD°m <>ÁÑ(¦Î¤6¿ Ü% `J© 7KÑùÅåiT7M iëÏYªD3nö'jqù#F4&ºQCHµM3ÐïPºøìß¡¤ºËGUÀTpPã¶ÀÅ®V/Ë|6 ?Fßë C¬þÏóõ\0¬& G5ÑPV* P4t¢ÿ ¤Ìy@ jÒºÀÃg¬ D-=Ì 2ªÍÐvÞåzÕò( 8ÆA*Ö®°EVå @±zw ; UM6×ð#ï'ï *÷ð¼üuü(ðDpoÞ° ©aWÀä]¥VÖêbUWF 6&DID X µðÈ q¥Sýâw ï[=!F%m¸ÎX`´SÇtÈ Ý C¬4 öf»»Þ$± ýGÀÍf þ± .Ï'÷½|ÇQ%(°S°+X'n¾ñ0ûj z ðFî÷eUÒllQé=7¤ÔÈ"0ÙüksË4èuF£g£º4izÞû k]è !âøF4G EÇoÞC¼Á¼þç4aà x ôÄu``W°ôÆâ`ì,DlôI!Ö0D2ÐÚB B;V -ãÄêe9®¢V ®Q>·uÆÔipd#EbtÀF4DÞù» MÒIõ ÁéEÒUÖ×´*´ áEH衱j¢:Å)ânÇSç µ }Ô:;; =ñÏÓ7Ìn.QC6¢I6iã9À£f¨Átu1 Eä.É) ¬ÁnÅE MÒ ¦!lm³é(>Âq5®¶]uhé #¡Ht4Q08T¢Ñôh rýf@ÂlÛ±mî=? Ð}Ãjó ïàg0yX«×ðÜWFÅyà h ¾W D`pNÄm'ÌDIðUùP+LoOÔ wXC¶úf¤®»;ÒÀ÷é¬%?øCFÄ>¼TòªÈò%÷b5ås[P¦Äßµ0 ÂZjøÄÆ ?°©h n¸M`½1~[G pÑKßûÇrfÚkëX«Ô*Db(8dø Ü)zpæ÷HàV¡ÑÅl>µ+ëè´Öi¬ ?¢gcöÀfªJøRê4Mäêj nÊ á 5"h i`¸}~î~ÀÅ>ÌàäK"¡ûe¾ßÏù~?éÂk&£Ç U³,×XlôbÌRWUOÚ¾¸l y0N \hhþRþ©.uöJ°Ð¾Hd£Æ%E«PîæWQ´ ÌÞþ ÀµphE_¥&Kg. ¥%/ÉM}8Ëbaá@þÜ :Îi¨ëKxUaª¯W n"6@'¦·ÒÎâKæj¤APØMÒu¸Hl0 ;*Ãè 5N1³@Ú$6 VJÄ£l}¸À·5ÊU0 éÃ|Á ¹ùÿ ¬XÉC cÛp¹=ÙûÁ8â¿ âÖ¸¯ë¬:?x4~óï"9 y. nB!ø ê¼»1eZ (h SiÐÒ¡Ù,pw* %Sk(> æZÝøÌ ÅT¦<xtë© XEÝSjéÒ?V@¼dÏúY£göfkíà ÒÄx)N%xÓYaq´º tèÞ«¦ÉÔR-éÑy±çÂX4w 5Ó ÞÍD 85³dù@X [ ÐY,í w ÐG¸½( ®fÜc§äɾÿ rꨱáuþqATcµ5g7¤èC 8 ¡ø»ª¥(Àì&ÜôX?L~&"ÞáH wï?Ha©ðÀ÷F OÌó. {t3×û|¸îÝ zíÿ 8¹z6èïM?Øxh¢æ #ѤS£µ@¼¨©U«¾¯qÈtì¼`%lpjÜ)Îãè¬4Ú?F0rGÀ;6GãNæ<=tÄ Iª:R ¨9TºÇ(@üA×¾cm§jJwEÐöÍ1þ2ÔVú_^M ¨Cè8_ϼPA<8³"T°HÆçJ ±@Ö§ÀRäbñ0o3ìÎ/« WÃõê7w" t*)\ ²/ø¨x~îPõâ68G>§x0|«óX_gã FÖ7Òa0¡AeÆcmËí_¬Úíà n @íØp¨-avZb¶Õ±!AØ?X=ON½Jàî0"Á ;NÄÓÏ.¹í4iÁ]:iAà oïæb¼R!zPCªKø?DTv+°jxéÜ£ {ó_£»ëCûÂoNî$³ ï{mÀ¹5ѼK¶+v)TúZë ×FD]\Nù·Â0¥ ¯Ð:¦-EÃF:É$òL Oyõ<Ågã>£6ÖT VíHË{?ó&óÜÐ:MAÒ¬3±Ü /kZÔȳNKfÌÙtßÞ<õ#é¨p¡¸ª~Quyÿ Xkõ×®ñ !N¶: ´¨+ aZÒkt˳p/zPÞÒRXÜ@{úUø2ëêêäõ=G½U¢Pów7§ÔF]¾HýÓ¶{Zÿ °«?x JÂ2°Ò+ ¦ ;i`1«¯YC¥¶ 1ó ;-C±4i! 4Bª´ UP]Ï19áþ`9g{Oð]Sö]åð¯eâ¶DÆÇPÔÝÉa¤0À¤dyjS» ôdÑÕn¡ K¯a мH&%© *ÿ ÚæúΠدgï:X«ë(FáþðwIZ¶ J¦À°ÀÄ|#©z ~±©¯1.4Û rbHgÔ#c¥ÄYA`i.#À£5.áï(;«>¶ qɧúDÔo)Âà§à@d ìg , ÒOÊAÎíÎPIÏð`|=A÷o ý`5v\}ݼ!_ Rn*h R@\é@ãZè/§n81( )â6ù%»¨-ø=>_:Ñ"ÅÙF¦© °mÆÆ9ÀT u¶X~¨N« SÛ¶6ËæR«RSX, 6 úU^)0[𵩽b,àµÃÂÍè N8s®Úèµãà(¼¡\AîÁÞM|Ü 04çÃ4ÏóÁ_5³ó·$i4¾d¸:64j&´` &¢åL ôÑLnèðÄæÙ:8DêzÆDBa¯wG0R©Ü#¹PjT¥UØÜDÌ TÙ®kì ¬îT/W p)Jªáah"ÅZóçë¬%ê×»oËmq4P!%© DÀC@ ÂFuvë`ß»åøÞ.Ì©ZD *×ý}ê¶2½Â<<eKUZ ôDøлÅÉóù*"ggxÝ)Ú èH½©NØó} » `©]5¥¬å¦=³,º¨. nÖëX% èpÇØ"àÃ:1ÚºDØâ²M/V¿³á´Ãm¸giäÏCû0ñÏ«5 c_¤iõíozßÀ 8b¯z0Ó³$%lc=éÍà¤]0¶1Èï®$²Ò/ ]mØ {? A-Ú)W«UUP4Ô=ä@P¢[H, û¹å£DaB!)Ûk)OÒVR»<bãô¡Öe¼´|¶à®n¨BƲ¯7¹<ää `&écܲ,Q£ºÈ{(Ô A]qà øENjµÕQÖȧ©WÅ^ ÖÛÐ £¦FpÜØMHÍl×g¼ÉBoÈvo@]Ϊh nîÅÍ¡A0 ÞÖ¢"SûÈá >¶õ5MBWrN¸@oT±Ý 'ô¢nÏSîòx?-ðW¸áQ¥,ý «à9¬Gö|àFbÛÞ`ÊYL¦ípP|8×ñ.Ë$( Ö*wöþó ëë}¼Á?·É .cª¬bSáÓèBÞìè ÂhkÓX6]JG k{Ôn3ZW/æ%I' Nã t ÀñÊ»°ú1D*Æ*Ð 6¡0&ÉÏÈÿ x )"µ²ßè0ü:øÆ~éƤW¨ÎY±FwÖ iôØ×âFUñyTy´ ]\h"'Îé7) ,¡ZBmäq\y kÔ?VdÖWUk@çÜ â¨$*Di[+ ( }1Ò%UÖð°"8è$U!V3ÆûT°]h+@'A:LãK×@©£UÁ!VhFDU²¬"©(í 4SEÁlÁ.ÛG^ ((:wÑÆ>çÐdBóþ²J'¯FHõmÚ5 f@» KÙ¢ 1¢I Uv«î4aè)ðdï\@ ^`T=ÔU1ÍÁ}¾4Ha ä±¹ k#§¡ ! ¤i Ö@pè,ÜU°"@ Ûè3P tÑpMÌ£Æ`g C,ob,éD×t)j¯ Áhðiùuc0S¢-mB;·£4ÍA¨XÊCø x ¨Q`¤Æùvº{þñý) ]_°%öß"_aGÇáh¨B1GäO» ñË?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160 |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 19219 |
| Response Body - size: 19,219 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ¾¡ñ¢j4ëÝ1«j(: "N HN ZZ2íVöû·£Æ£*$ ,A£e¯Ë$«s4°óÛJno¥ËiªH*è wÇ7¼ÏÅÜÆXî}Î7©Û Å5[9ÕkyÝÍnæDèÓL¨ÚH2²r>¿>¥íݼÍv $V®á¨:¢ `NËGRªoDíS¤=}×DâÖÈ0r"HR·^ºâjå±c½ÔÆa`ï$Øm K5ÍísyÞ¿¾½ü;$ ¬´§Ø9Æ2Õ©gpâ v ×6v·?¯¹Í}ì{¹ïªúP0U§^,ÜõÞ\÷ß+qÆäXºãµÛ ÐCs#AÊ~¸ANÄfNååô¢±ÇÝ˪µ¯WÈÎ]¡Bék/*U'c«r*ëË/AQköiçÓWÒ,+jV½G|uq²¢v`g÷äÏça\Ê¿èTw¼¢$U²Ñ`ïTÀÎoHçÓz WÃfÛ·J7þcMغri H"¶tcãå Ñ×Hj]=òó7qi¥«Òù_EæÓö5 e6?©cmpXP·wÑ,ôq£Ï è_Z·sù¼ ´xÒE¥2wÛ9º úôtdëzÎÅ4«öD' lèÐål´PK1æ¨ ]l³Üù¦zÎe"äì<߯½ü¯cFÛ :VÖøg×>[ú4 nã´ÍWô:8Üí,të·UÑÏy×X¶ÉÊÄzF³¯kIÑ£yfS¹6ÊJN¥[F§oO/I1«Võji¹è\GmçØZÌØâ ÒÄR{Ï ¶ØB*¤S3B ºÎjÿ qB÷Ë®êfj2OnXe 4í$ÕÖ |ic¶8åoF¤Í ±WX` ȼô±*9jÖ¡íy/\þÓêà Þm£wô*º%κjuoæ}Íîc§@ãImq o'C9À6g[nÚ¾dc{TÅЪ¹µ]Lm9qõÞbÙ[ ^vÛhXÏi X;Úi.` -R¹G ÷¹GÁRsû¯?ìÂÛZ&UË´8ÍÌcñ¯-HÞ-Ò V×;Wcç[rÜ_¡pûÒK0_z¢ÔÕ¦-}+¾ùJƶq4 ;?B¨¦¬ØÓ.µ$\P£®±£BSÂl2VÀ½Ìk©cë>QèjÉ[ïçÇïF¶µåÌîXªmbôÖ3ï3Ôù8jÇÏEÖ'T´ô ÖiÈ`7 BÆ6µ>Mò°â°> é^kËè6ѳᤫYÚý Ïï0à궻Q-C¡nH_Ç]÷Ï=)mÈí®bÛ h<ÙÒÇhVÍLÐøt ü Ü U }´l@¶qÔ §t?¹Ð'r|X1´è ]|² p3ºð ú{ D2¿=ÄyåÊÂÿÄ * !0 "1#$2@CPÿÚ ü.ê¿ùëãÃw~@[PZ7vï÷áÜmZ[ZYYWÛq>7bi_ATßÕs-Ê%ZüçÝÑUnØünÑC«°,oãsZ·U¯ºå¥ }¤UQ¬ù-shD~ï¨ÛC /ãs´ßãq¢4=t¬RaJû®ãíƯ údÙ½~güu@6¯"®{:¹¿Ç$ÿ Oíc`¯½ð²µåãtQÑææᶪæý.ÈëØ9æÛ Ö ²» Âêf×î.¥OsPT [F#Î÷ôäÔ$/ãÆ ÎõPÝÖü _²Ù¸Më(·.á G TÀ: ÎOåÉ~´AÔöë«hP°Jº-Õ72/¾F2 CôÜeV;ù,¶±Jc÷÷»¾ÎQZ_µVS¹ §¦Æóò¸êGF´ò¨ ØWÊ/®êXÂHÝt]hrrâÈËãÉw²<2)½áÜahxFU 1ü¥Õ×æƱìÅ̼Kð3Bq?õû.\hQQmu.7?òl/nBkunÀNÀ´ ggXÿ Fÿ ;5 ¨×]óÀC;¥\kèÝ o¯Ñrý. eÕ³ ئâYò<gºg( þÞêw(V'$h÷pÓ V AòV÷.á\it;ÊdÒò Zê6ZÐCâ¿+ô¿K ãvÆÆã8ñßÇg·± Å`¨Qþ&ê:¼Æÿ TÊ3¤z¸ª f ûF^ÄÜÛ6³öã1®åÄE`Æ2ÛK^/Ä_Múñ¿! lèüWUañ˸¼ÜF}Q-ðÙFóu ðð°lßΪæý·Z*1eåâ4?# ÇM³jÌc(_mjî ¯ªåÆÆ©£Z¹¨¯*òhbïÆÂþàd+b´Ø]vw·³¿KUq OÝËdØñy&ì|± òd*Öò[ò¼M!(*ôÜÜÜíøoÒåË.£tkÜë |vãq18am£!ÌGÅ¢ô¸pÆ£>'kbr ª»TPÐÕzoÔ®-¶· ÕÍþ7.(P¥Ïç@Ì6qêN&Md=|rµÙ®2ñ¦ÎËspÙ«ï¸Ã¦8o?nm=?&²)£v+ð"Õ @õ_î¼[¯MÍú_¥Â.Ë: rÊú¬\QYr¥íä¢ø¢s+ælàâ9ÜÐÀ§ r~é ÀÇY1abÆöÆ¢øÂeÓòyËJ¹¹¹¹¹¹¸W< cßp®Y N¹Ç!êÄ`²®©¦Ó,ÙþtÚ³´í 0j/0ñYÁ5Íkk<Í,H_°Ô^ù^]£æ ʹ¹¸ÒýDî¯sp¦=wuyÉMð3i7#É´.AÝ»8 ¬ LMÙ@²»6PÎc òo§y¼¦-Vp V±ø\9úÓ}([[¶ÐÐëq¿Æ³³¼ÕCÛrî ôݧ;!FlA6 ÂË#|¥B4æ_ëkäÐ}³±}ªðnwý·Á õÁÌGc4ãk1]£È¿íJr¯Öî\`ÑKXy±-m- ]Ê?¬[-×iw *«Ê^Awø¾'(ʲ²O®&u ÷"Ì 33 XüxO(T3ÿ BúYpøñräZ²d*æçiGóëráÁÉjesøìp2få~æfä3 ¯ä1ëôSwrîXyÅâ0 4µß·N?ºgüÎe?'²V.e¹jÑ @¢áÇCí°²!¸»ÝÕÍÍPãõESsrå¸"Ò. Ìò¥,ËÊw{s\7ujȧës:ïÒæN1ë Nªÿ ^i933*Ünwxw¾8üP~fy§?Îì%Ë]îGÄ¥ãb`[ró«P âPÖå|ÜÜÜ»DÂòn°ñ]ËɬXÕùPî2ÆÆøR¿6^H¬2ÈÝÁ+âX.ãEy9*,á¬Ó t ä±Øöåcx©UUOÿÄ + !1" A02QBqÁñÿÚ ?¹s(_ú/érþ£³S.ÆŨÈWÏìȵbo`LUóö=0dsÄz /Ý}=̺Çù ú_}ÏJT6È;s6Goûñ 'å=/ÚºO3{Vù åJ1ôft;|JSô»üN?_MÊûuæfÕÉÈüaBÀ.W£ö éì0lg¨`£paf4&¾oMåÆ YjÀÆC 3g ãø¨»,fnjõ55\?!3räyùûQ¨ÄßR¼2¦ Ц¸Å\ ìy¤#!iXãj3]®CÄ°E´¬|ýî¨~Bæ®×º8¼ÛÈØW¡Bç©cß`cb¦ÄÔfg¸Ç¸ÚÀÜÇQÉ2?D[3>¯²@úÇ/3K^¸ÍÜMdÀÚj[ó3æ|¿Ìý¢ká9MLÇüüCµuQ2|. &` ¹Â±z°^âøW§ BìC7°Ù¶n¦E£*T©PD5?U »ðãÅb½õ1õæPêRsiÆ&6æº7ÇBl¹3??òTÇ ÄÚÔãd2¥A,@f*±%õ?°fÆ·% ±QqàÂb \Db îläöÇBfØg^&*zv?ºÜcá8Í«=P2ÌXY!@@¨O7s5þ#kün¦,Có0 ©þf|àÆÕËí5Á®¹ûeÔ( ÌjQ® q±ó YÙz Jó¹K±k Ö¡"ª{?Çêd¶±uæl\¥EYt'¶ äg³Os ª¯S:ÛOjùx¬$(îsùBHz Ï Ìñö Ì£õ*fcU ¹SUC5©ù©ü4 âÿ ßýL±¾æ^§ÿÄ 1 !1 "Að2¡0Qq#a±ÁÑñÿÚ ?ìÝæÛú5Ø C@Aý+q¤µ®@Çô5ûUrûGÊñà=8h|ãÃñÀmsÁT<£ÆÙñ.óf[éüÍ3«/qànD¤(müs;ñÆ=f{uµ±Ç¤KÓ¸g ±;å(ÐÞl Ä.-³jäNðct̷̸馸!éé4öóà¾é¶iun5¼ÔÞ0bc _ £!ûÊÎ ¿G¼}F7Í Ê·#óµ @ UÂÅÜ%õ°ÎÃÍmÚç¥(Ájèf«HïN14-Ä^íÉ E°7O F Ô q^ó*%ÎÜmÆfË u¬r{IUÂÑm¾OI®pWvéðÇDMÂ%é«;z]I_Ò<VÙ°f[xuþäÄÑ`Üæ_¥ÍÀt·VÅenúbWøÌ:öªcPËËþa·Wõ,6¾;¦÷ïíIfÓ´ñ47¾Uæ)ñ4õ©È Û5` Íc ð2eM½¿oÏù1Ú¿y\t:*õ ·f¥¬bW·ÒÆp%îPzx 1¸1>S5:]°ncm ùûM6¯k8ù ËQ·nS5fÕnôµ±+ÔMfß1o´® Fܽ÷Åg¤MÌ&%ÆåÁyU¥Öþ²C+²Øf¯vyäF^ïnà >GÝnäÅÔùöæZçÒk/ry@p¿Lªµê º»ÕÛ,Ô>7%zì@ôæ1ò¸¬ý °ejç$MF¼o/úDn _còG÷ ½}ÿ 0é =ÿ Ü èûg ÿ ò.¸ )Nõ÷ïß¿Þ ©jÒ¾²«7®faFx55-ÜpfµígÆfá99ò\¬²á§¨ å ÄªÔ Ùûû1é&¬ ° S0PþÓûO¬ØÜEþ ¢ôGïlbÞ2-ëÍ[¨²úMe¬µfiýæb²Á¹ÿ ãóQ5CÈL¼#øÿ sHæÛ¶·¨;6ÉIÝÖÿÄ : !1"AQa 02q#¡ðBR±Á@rÑáñ3b$4PÿÚ ?îgÿ ëü± Ü9ÿ !¾`°¶ð¼A(t[6úåfûNÞº8+"<rKAVQp§/3¤«ñüüǧ0Fº *#yÖó?]#ùvÂcí÷,2éåÅXǶ9µ ÓÀ![x/Üx2Dg ï|½¦ `ê¯=FOª§hUg=µS duãôQøxx&ÝU{ Îë]¡û?^¾åôÂ%¢×îN3 ¢ÀZzøäΤ ã2:î;:ürF>¿ºc ölîØ7LdXÛgbV§ ðë83ßph¹ÜÚÿ vâòÞþ¢ËK}c/ºé3û.ùT·NãG3 æÜÙ pÙ{*ù5À~?E³°RÉÝ º¸yf5âëÞwâ¿Ðj*ÝwËLÂP' 'i>ëd'Z÷JmRØâ¡ûÌkþÔ¢Ê ÜùÂ=0¸÷2ù~±0Þ^1Ð Àò÷7SË Ï!PÕÌóçöMÉ -Õ 3ØÖ Êb0·|<£h ÃT6Ö7-áõXǯU6´W¼µÀÛ¿lÊ5(Ú]ºiçÉV©RÁ³Þß;¾ÛC¦8ýxê±ks¯ß>×κ´ýýá L@^NJ Û2°÷þ¢sA9#4hìäg<|âV9Ôj7%墻¢##$¨q®ÍÃ0wÇ1âÁì<6Ó{[Ã@ìôûÕÕ¦+RÌSkU?á©»!ÆO *±m;«ÜÐ1)®$Hok ôU¦¥B&÷ÕS}£8'6« 8Z±§àZ'S\Àn÷ ãÕMÒw´}B.×â¶ÞÐò×4\Ú|_ÑS¡¾fòÉáÏD1 9(v$i"Usí/$Í2*bÚntV:ãXê=U9\.2{ }íaë¢eJmptúª´j=Ì:OÁ$uð¹ .·þÅ2HFpGtì:O)RÙ3'_Íxth }P}7Ò ßºg]U:t8cDj±íHTÍP÷Õk-§¿Úz({EìqÆ?Òx£L[¤Ýõì.c ZÀw$è¢{KmTÁ¬ËðD3¦h{vÏr¨ó+ÏJw`àã¶LrñìoÏ¢-ö}÷?ÌíAôÞæÙ?t¸\5ZÇ#!°»{¤KOÍRo¼==ëU.Æîºÿ nÊ Ú%²3ǹ¼D&ºñ$ #°D6ìº[y~«hÀE¹ÔÚÖâ]® ¶Q°ó \ê¾ÚP 5 ¿U _{væSJ`T8x8Þ 0·xàölhCoÖ5+kE̵°ÙcÕIt¥=¯uØ»° îH²Î¡æ9OÍnd N»tsÓ¹ö $ Â-ÿõSB¥7ùµÿ Aî¼3£Q÷ú*Û>ß3%§yløLªsKörw±õ ïö'7Ú+]Ã:'Ôtß? Æ©»çt!q.}¬{XíÒåúöØ èRÛ÷Q Ó àâây¼ҵÜÓÉ´¸âÓÝʪ:ÍM:ü¿T0좶³ýéòܶÅÎyÑÃ%¥ìÏ e>£% ÉcôTöu)Ó:<ê9 qRÂtà2·Ìäa $Ï´NpÚ:ñÇDú;XQ1(¹Õ=ÿ D Õ6«ÉÃV¿õM§\[v¼¥lö6È ¨Ã`.}¡ó -|QuÑÿ ]T¼ÿ ãÏü£"ô÷LDáÐu_ûFÆ*@wÅH$pRpÞóîüb8fZòbõ ÝÞØçÃã趮¨ëGáhm¹ß ÇdHïºDÂuzÛ´F ¿OÆ © 5²mä¬è ÞýUùêîvàÊpi qåàxjÖ`nkhÖ Âp8½®ÍÛ[wµ ÒÚXAÌˬÀHÎRe[êió⦤ÖCÌü¹)3¦æ±.Ü> TmSå6·ÓónæÏhi0u mZ.¹üGÜ¢$:(g¬ÆfZ2YS}Íäc+òõäe¯.Çt÷FØ.ø&3ÈGrÅï4fìôN/¹×béÑ ó*lªóc ôMö¡å©Ãy ðï [fª c 2³éÊkè{¦w6˧öãÁlÜÇ 24Ò3$ykLÁÈÆ«dlk@Ъ+X qSl¦ÊµÌlãEL ÎØ5 Nó©º A¬Qu ®ØZ^Áu§"e²-'ª}IÂæ»GZuùGZì6 µÏåþ4PüªÕIí:|B©Q²iÌóTö hB$º_ùÿ ÍS÷Îóʤʣx¶A-á÷)ΧçäÚh$ñM± z'C`©NkHoÁ7½SX*4æ9&lMÃ%Î 8D Öá1æÜ7xö[¨ÔOÏtÐûaÏn0kxÚàÞ ¾ÑRô5ë¢÷ta Ù3× àt¸j²ÌCZmpý¾©îÖÓç|4BTÆ?ç¨_ÄÕ4 Á¹!ËX ÏsÞÒsú¹ÙÌ«º \Zà?äåþ>H8¹» @Ô¢Ò 7 "ÓæiÝ(2Ð<õV¼gΫF¨Þ ªQ£AÆóù ºèíKG4Ê©¾5# 4Ï~ÆÄcªÙ¸ËGôqïÓÜCë£ÚÚpdÀþ^¥O+i7#Áj2y Û^ÀDÜ[Ð}¬DGßúVµ oq=;0'µ¬Ù1%KÚßépÊ-"3¢ àúx¿/dá>ÖÓ/Éûê³- ÍçSþ&ç541 ¦myð4BCf7ã#æª2Ïví øpûÑC[å7 þ\Â$ "ÚNàS:ÑÖ; gµÅ¢mê:YJ«qaÕÇpÜÞ}ÿ sIÏ?ÑwÞ¨ ¯u @ Ñ@T.uÎR«)0F9rìWNû=óð-'Oì®ã~]Ýß $F§öçØö¼eÞSÈÊkZt<Ó`Eã «:ýåSÖé$e]§ªb,ëQÛ±Ë=4T¨û5+0^x©eGT`?1Ñ n$Ô3÷Õ=u73_kç L yõp2£ØÁ¹ÎѪêθöÆo¼Á/CÍoeLgºXþHøËèþ ÝTÅw<qj© ËÓ2^N¿sC't¢ D4È í²Ýâ¥ÇúöKL±}&þ1?Ùp¸+]]òÂ,tÂk;1¬è7äpÞ?D ÏÿÄ ) ! 1AQaq¡ð ±ÁÑá0ñ@ÿÚ ?!ýJWÿ À±ú§þ+ú !$IãªßÍý?÷g% ýÌbBIB#vÊà¨p×ûì`þ¹ôUÇôØÅ´»ßý~ø:¶Â2w®WÇáÿ WÐÒcÙ ¤9 ޣˬ¤,F¿ÝoX§'ôO¨2Àääú¬þ Tâ 2-'ÈK&sÌÍÎBÿ g\Xp`s& !£nökyk~⥲O |¦ qX?®KRMÈç4C;ú¾¦NõqcôO"\cdöb ]®R×Î@¨!îsÇÓ56ÁQ_õq P]a+Bt<½ uÖ|[Ô/Î@ÎÊ:×ô}1V999>Ä+;`&j|*+8÷äf$¿P+¸ö¶÷Æ2ÏCÝÏOa2HÓÐÑË>äXĽl,3³ Q rÈ£ !dÚÙíh | $ÉÉÇYh`¿ißO>Äj21CDÚ-PMÆ,=ÑɨÚKúDÿ <û¿C"s$ P6{íO,ù>H£x|=}7Éá!ÜuW8tô8P¶_W}d¾ ïðÎD?eO¹ûb$«åX{'N.iÒðà09 EÚþíÁ¡ÃxÁ¦a@ 5¿ãM&*|üa ,nQ # `%ýqI,ë':L[xÊÈ}zràãwÅÜmý°Ð)Xú 8¡ûå*]{Yñ.ÁÆ Ý-Á9'7 ¡H×M óÿ ¸Dv~!¥àýðp+o'] q;5VÑcH¢'l ã~Bº$r¶å ¡Ç ã# 1°Ô ªÒu>s&(ZMILVÂ¥S×¾kEÚ·Ùã#gv¸zO¤ú¸ë)Ò2K4§ w'¹. ~Gì0½§No¢ÌØé0¾Q8I êê(ær½Ü4hI ¾øÁF@+q#öɾ[mÉóíQ4CQ ,8£8³¹)5ÈöiÂàÔËÖôÍy òQ'h19 Ê ¼@ßõ #-{!Ç_à?¡Ç ç ÜK]vÜUQ×ð C)Ûmßq8VRoçóíz+(ÜöÄNËÃZ²¾?פÄ7Ä#< 0±DºÏe§ô¼*·µp¯El<u;Âölà"7ô®å8$ ÷ ÁqËÙq°\vÇÍOÂG"}Y»áÙñK§ÓËs¨q¹¼·ÞDÅ Éôÿ %2YRý?K(PNrС|ÁÆ[¹ÑkunSTh¡÷DsI@ WFvdõI¦ ¶Þ3áë'''''Õôwð`Ál³-HÄbA)¾rgCNËu¨ ºxxë ³`ó¼¤ lFýÄøÖNÞCðNKVf¥Ñmd .gÇ/ û´×ÆB@± ü¼Ïé''Òcøe}îÚ²üå\ó1ÛQrÿ u?é¯%(KÖ F(JÜK^ ÂÐ øic¬× 9Mà^¦"xb!4 $øó£ÚÆfÓJuægÄ`)«ÝfòÑ]ù2·¾ø U¬¹Q$ûßÑÀÔtBsq"K¸-måç$QßOéÆfÀ7/ ùߤúM Á8(]ú*pf Û5çÏïã 2I9(?5#2¡'Ó³ÛPáÙäåyÁ$ÞJ©IHE¶Y5ö?r¦ûÑ E`ëÒrrKOM1G¦ PíI\çãqñ-Ln,ª¯¬îì(Ýç§ör&JV.gý÷[\vÍl§Å¯8Bª ηõÃ]µ¹0&FpG¿ìÇ!ËÛ©K ÈÄès»GíÖNNN&ªðÂaJ¸¹ºñÉ]áöÁ@} d2;©¸é 8Ù EíßX(DÜW:M?t_÷ ]í]OJ{ p©7cE]Ö¾3iúWÕc¬qÄZ¸cÄÏà\ ×> }ñMߥî?°}²@¤9,üý² FZ4Ûܾ+¬Ù¦®0X½503@ò·?ù6´òR¶>ºûä9¡TÓÜÎdItfBã(BÏ¿{rsиQ 0 ݧ¸ß¨©\@@`8¥rs|s ñppÚm× ¸ Z ù«'x»ÔÓ|óªY<ýqAä<è>´s #VÓÒ>xÈEPñ0HXgGµbÖ/YÉõ_EéH Nq&3¯$°ñÍ)âzñxÂ"äBç&<I{òà0r)ääË@f .¶þìÏüdKS$]ßËÇH''Çäb²¯g½Ä÷Äk¡g @rex KØòÀºu0ªäÿ 6ºÚ[ ÍorëßÙÊS7Ö%ß».O¾þù4öâá©üÖ Hi,B`¼Z?yâãxóbÔqnCÓÓHÁÆAíòLè 1sü¸F D Ð01Gbqãüǧ5£ãó47%àÉ¥ ij1&þ"2¢¦59nqqå¥áta&&¯ qU%A½i¨-úd Ë?À_Ê(¬4Cqro;Øã®ÃÆ2fú`q°ô)èø2±D,d²}ôß5Í3O@Þk&Ø%x3]6G<·SoSÎ2×°^ÑκÅ8 8ì§ØRs÷ÔoyDkÏ?lè¿ /£zrtx<2æªÏßøÄ2!Ð èøû̹va§Ùóç$ r":EÅ}'â²"5¹(3¨2 Ü{Í`Kcx f3ë6G8Ço ¼á©^£R(|VMFDÙ»Ö^¢Î(÷ô~.+ÍÍ&9Ý Úª·ë \{~?muIÁÁÎûÇÇë¹ëµñßv ¢_Û>¾ç9_¢nQ{8@,¢ªwßOÆAX«qQól ÕM?\nÌ_:æzþt -W÷.KvK}Á'«!ímAæp ËQäùq 4&ÏÎ?I}*ÆP7XO¿ ¼R \hõ0Çã 0ȼ` @±1¶ãë^S¼8ñcÍý{©h=8(P §ÃÉP8<°ÁÖÀ7¸ãëXÐ0lK ` Üÿ 9Kɨ`Ä,*¢KX7 {8âtÂN½A4íPú reÂN\ůd^7±H ¿Ó **3øáHS_äè$S I=²II·õºàÆK Ù1°äë RÚ=ÉMü1Õ JÎÿ =bôȵÞmf ~çr|9~q*É ÓB&L)ÔൠMÕdú$ìõ߶ ¤Òûc& ÈKs~\VttÅÄñÖóð$ ¯Ä]b»øT=ò)µÁ;Ö6O$q Áã_CtL}øÍ9 OÔ ¯-¾,*Ö FØ®Û}òh$@ûë)SYÇÖ~¹4OH}Èt@z\80à&)ÇN8¼¾uî´Í Laõ$#íÎL299Ç-bJ\UÛMª¶V¤wÞñ´ÉUéJlRG '8?{U|>Ùp³ùÀ¼ÃgØÄdJPcoûÖR"÷¹Åæûgqªq|´\>0U'aÆÞ9-Û'ôÄD æÛðòã@Ðv7 ²Màݶoóò¯àOx2 Ã+ý§ù^|b½µÖ~?ßlµgØpÑ|ÖJhÙ&È÷?ÑÂ0 yf¸ë$÷ÎÏ^×5ç DWÆ!Ï p5íò©ÉE=ß)³ÚxÁÐåX ¦$ÄæzÈá[r½U»ÍôS Ûõd&mO³æ~5s$µÙ.ñåvQ,xbj!åöÛ¤äfzUÙ¹4÷);ç;kÈÂa*|¾Às 5ÒPÑÖ%¡$Ø×F·IÆwFh|t{¹ Ç{·ôÄdOÂ|aSQu_¹:Ö!Õîo ¯ îç÷ OHÌrË`õêç7ÈTr 1¢! lxn@z {{9ÎJcËl/jGñ6v³ Шykç7(íÉàR'-ðª;l~%Ï 2ädY/8³¸4`=ðÃÀóu ¬\ì:ºâðiËÜu¾p+i;ñXÌü"! ½±â/´æw! ùÎ,¨bâ>l,Fìd»EW¹§nÖ'QóçÇ/$X\§ Pò÷õËÒ /× ÄT,¾Ï4ôm6Þ(äÀÒdiUîc) ÿ !rX§cô§v(<ÔG©Qu0]G¼± åF)YüXÐhD v×͹ï××êJþó`«'Ù;KÖH¥(uÛíJÐ]Sq{:sÎ ¬cH_ÒqQ#¬ò#ÉøelêÝüápRØB.§,»ìêâïa>Iþre6®sÛƽ³3U¹ùÞ*M¾ ~ÙÜâ"<¨wç! )ÄSÇõXlè*+ãX Ä@©.8z×0¨µE½ 2ÿ F©é·Iîc)+l éQ¼3 {VgãsîÆ¡+*J¸<<Er Eµ~ÿ ;& JeÅóá¬,"u&§ÌÎHË×(Rý¿b³Ê´9ãZ¯0Kf@ # û;ë/õÔ `¿ÅÓ¹ïÑ/]3ÝÀ ûþX'äaø~qeòpj¡9¤£Ç¶"á¥. oQ>ÛÀAJÍ8XÆpø'yH§'3ÿÚ É ë=¯ú?wÿ ÿ ÍÅûïÿ ÿ 2ÿ Ïþèýïã Óp¢rÀ£Ö<Òþr+ªÙÓ£ø$Á$¾½ðAíkQb Ìü:Ù*+×ßÚ®ðZt»º¤Z'9þÀ¨³UmwâQÄ4L¢Oúyp5ͲsKó_Yßo<»WÞ| :BF\þ,}+Hg=ÎZ¢öl5?ÜtP¿¥{ÍBìSɯh â8þýп~(öò/ÜÿÄ ' !1AQaqð¡±ÁÑñ áÿÚ ?i 4@ùé^ÒY)âZ¼NgÓ¯Hî.\¿ ¶²¬{ÌɾÓÎø_nê>8\(U pÛL{ÜIR D+AÒaà-ÀK©Êááztáëùã ýó.\¿7G `7 \¦:ñ;é7prÛ|(j\¸7¢¯sZ l@öé}eȱ Ûyúë ª uë-DTÍÉà` èo^oÊ [W= %IÌ-oͬ{Án4¨S \j¨k¿hÀY5u̸ÆC¬¼¯^¼¯hu m߯Ä((ë³ïrÆ·ëþÝÜ+çëç[qõãÏð8éZc<¹Lߨäã[p©¿]¾ù,Ç&Ý÷ôÍÒ_xQ^Þ*ç¯ßÆÒ2ÀW³ß9^àpBRL¸_6 kÁËßÖt#¾øGXk-o}+5þ&<J"\n(¬G¦¢ôå¤GÞ;ö÷Ô.¼âDA($:¡.F4±¥è9ï×¼Ê6V» `õçÄ!:Ýs¯ºøbÔ©VAMíûçå(׻㱮x_~¹&¼_®ñ±¬Ñ6sÐë¹o È@Þ36I%âæ eÑ¿ÜÊ¡W^_ õêô8ÿ Ía"&¯®1tïµKp1 Wä9ðdEF dö¾÷é;ø ¤u2LZbIn®:c]¯Ki¼' Ê{@ÜmZé¯íCß{ôGEÀ翬Ï/£wëÞ+Õù·àSä¥`ÎûÌÚk {ü3ÞÑ@µòîúKEÄªÚ ,]IÊéÿ aª_}±*ÞÁÒ-²¢ Ëpâa+1iM [ñ¦<ê"Ãô|:úó&¡å¯}ó²Cê 'ïRÈù?+»«¾ÿ ]2yµ¡Ý@ÄÛ·¿}eÙ ÎÒþ Ö 5 1en ÁP jÅ d ïïÝy2´+ó©§ µÑ¤¤ E[LüG\Öd¸ùFýe.ÖÊA¥¯F À¿Ù kóö عâ%|ÌÖÆ,CÌçÁÿ ¾ÿ ²¥\Ö ³ÿÄ ( ! 1AQaq¡ ±ÁÑðáñ0ÿÚ ?m ûÿ D8©áßÜç C¥|A ¦cßlè ïßEtÈúQàëW±ºóç¾æ ÈÚ½j®ýÞµàÑ;c£ >y8¾¢ 80µ1ü½5dÈ,L 1H2ä#E;п ð¬ï÷õÁÉÉÀÁ1Vf8Y%:i]GLz£úî[ÀÁ*ïÝbtâ7®ø$Å â .<Õf ã®øîN! y¼út®ød¨öøÿ 0[«s°(rX7 K=«& 3EM{äx$âá]úuiã"I®30tt9Ú~2¿ßIpfÉ<öô#¡=qYfnµ¨Ô]»««¹H¸µô/qXÐ=& ¾zõÙæ°Gy<GÇK¼à§PÉ W¤Ø»? ¼Õ Vfôòó ãË Æ7Å»¿JÂéÆÑÌ}&q£ 1ÇNÕ«D`ªÔ§XêÕå MÈby§¤ÎAk'O×÷³b^;ÓK57£]\7QÞ²q¢p8SÚ³¶+zuítÄ s®' Aòtí>W4K ÁMî&«¤ó¸Áú Âù öÈÈ::ßùx}î/>½±á@êÙ:iZ7[8 ²Ôíò®Ç è@2 x9¾W)ô²½j¼1c|ÆþÐóSß- +ªòzÄöï8è300s'úì Of?º]d"1²"µ´'_ Âr| ãåÖKG-V$æà&Á-×N4§¾NLTäû'ιÝ+ï¯OOVVd£ óûÎ$)¢zÅvfßr°Ä¬ßÌ3Ïç;ûà \½ñoæ<Ïc¬ääâø ÈNHù ¾æH$4ÍûÓØy`Ú£Òå Í6Ê\ÓÀ éæ>1£¦b:þL (ÑdQØë}¤QK)éÇ %ÞA×Hiîå§Ê'ÛÛ\àø4 ^zåY£DaIÁé#b «8®~ËFXzó §)@L]ÄÍÖïú±+ ÕÌ?<ãÖi7+ cÁ ÂÛÕIMîcú0 >ïô~p`ëÉI8²ý=>w$Ô-#|Ô×¾#OlX8¸lýðú{`^¨qùøónäÎ!ø8¸5"L½ üþ£(G#pÑ Q|K¸Þ, ÊðIg£X>áWÌsCÓÚÂ"ª¥ °eÈÿ O#SÁ,¢µô¤Ä9ýDõax«v~zÔÇ粯°DX÷ô Á× çaOÊÈ]ND-F¢ý4möM¤jgüÁq@µa~ã¾8Å2G\Eýýøä®õ³ÜÈ÷H) h[êfñF´x m Ø#O;ߧ£¡y+a¼ÚÊÍþ£ ¦ýg@Ç÷_îq àíoùìd£'RßN>Ð öÇf={áJ.*·×¯8°d{Ïèòâ°$Ô"« ê¦0A £f ¬¡eÞ¦ü²IR¬æ}5X 4/÷Î8{ÿÄ ' !1AQaq ¡0±ÑÁáðÿÚ ?ü_ÅIJ`~Õï Ëþ Ü4 ûùþÇáùY µü[GðXÆ° 7¿Öh°âti`@ØíÃr¹råËþKqæ#&; ûÌC§>É hiYîH ×þ9¹7{@7M µOPiüØŸý~~ P_Ë¢½pT1ÝÅ53Äùë¸q©F®Ð ûàØù øþ:ÃháT¦ Þ|þñUbg VÒz²`Ä*Îj¾(:EG0ùeüS¸³¹¼´gy#÷÷ÄÅ^¿5ÏÊÜX.¸ ³dé X¨')WGX©SYTaÌÿ § 4§².ß91"on"]ÁX£4Øá £S@ôA¨6BÚ«Qvû<Ïø¬î-pDv+Øä±Bà(- ¸ xLè` ÷ãð· `)$Ð +:¾ï¨cFÀ¬ v ì·fCñ èêê¤JÊ( ½ à@çµê¸?åËø.-bãW¸½ÃPlNY\©sÙÃÎl+Ô¢L(àÆõYF> 'OT¸#óó÷5C¯àJ- ïD¯¼hý°Di ݱT >° _ïÊe<IõËù\V"= *D°VDoxle×jÝÌ´ÁHátßY }7\ÿ ~ñÏÅÿ ~? ó/RüÄ;q /ÑÁàNi9´îAêB4Ý$¿ ¡Õc & ¥ KÏ5Sév}Ø[Ícl ?£c-ÊD ð @P½l©2 ¡×@RUÍõÔÒS¨ ;«xÀS¿ÙMëûü/ã{ÔYX/ÕÁL¢]ù& m éÙ_ùø ,§ÎSçï.\¹* ¬SÃRÙ éZ k z>Õ l ~\nà=Âõý`=0C_ï4P P R7×ÿ ¼Dsôõo,' ¹Ì¾(GE .Øw}C F*«]qm,DÝÚÔPxá Zîu!ùÅYÃT_UåJ¢QhÞµEÁ ) 6b¨¦º:dpæ~¢¾ol1 «jlÏÓ5r¿¢ûÍôªÔºz]|O>_Åf-|( d{ RÇúTKÎ " Í¡Õ**bÒÝYý?éÉ´ z ª@ ¬à×ZÃT Þà.I jº*´ ID\Ø£¥ ýa6Ô=GÀU| ÁÑÍ{Mxc,ûñS*o×x4ÙkÒÜFËÓÀJ6éZjÛUÅ#è´@l¢}þVçÆ>Ñ\³ ¡ÿ ç{2PØM÷Ì*·erÒlJ¨íÔµÝ'Ïôäàt¥¡x[EÔalÇÒ_ÈWçÁ §Î#þ³¦\PÞÿ ÍÆ# @[ [fï°P*¨o"&FKµÒÛM »ÍúÕBé! ,¬=JSd%Ò°²Á! TòFÈŧ 7°¼RAFMhÀtOéÃÖPãvN ¢ÂE du k(¶,EHâpây}ÝÀdâÇáºÄ õù` ßrâßÃó8ì~Å1©ðMÿ GÆUÌY1} `pcyÆÜØ úTïZHB6»0qm@T ªúÕwAv<ÅL>_Åf-üÄà#îR?Y,Q«´w+¸ÑSÌ jÛ×ʺ4E^P:1C3ÅKbèÚÔwûXT$`*á±,dà¬IG!Ð]: ¡¥)Þ#3ÿ 0JYEoh¼nvp ª©°·ÖSzl=²VÛ* n¦ZÈ e Nã/\©èx¡c<¯íü¬ü-ãÔÄEÏÒÂJ$!vtM ¨då:6È(H *ÖRÂV½I©ÙbÃeÔ¥ÆFô§BKWȹH;¨Þ_£5þ3ïÞ <>~úb¿/ÏÇOÞôÉ:4á 9î%Í õ>å/Áê @@ C#TE,n C»Á%Â|QPW"`O³L¨CèR)R¯U+ ÁH RzÃ9ì$V a\ªÉóì!TRÀ,}5U½"SÍÅè:vORЦB! Q½öïþòå~Ãg£ Þ ½Ä%®Þ°¨!B¦ÕFéf/G!»>¬TBl¼-~LÕ>L P ôÑX¿1DP `Y°lÉ1c@_P¬ýW)üÅ®:?×Æ ó§ëÞAMæÏ aÒé³GD°m <>ÁÑ(¦Î¤6¿ Ü% `J© 7KÑùÅåiT7M iëÏYªD3nö'jqù#F4&ºQCHµM3ÐïPºøìß¡¤ºËGUÀTpPã¶ÀÅ®V/Ë|6 ?Fßë C¬þÏóõ\0¬& G5ÑPV* P4t¢ÿ ¤Ìy@ jÒºÀÃg¬ D-=Ì 2ªÍÐvÞåzÕò( 8ÆA*Ö®°EVå @±zw ; UM6×ð#ï'ï *÷ð¼üuü(ðDpoÞ° ©aWÀä]¥VÖêbUWF 6&DID X µðÈ q¥Sýâw ï[=!F%m¸ÎX`´SÇtÈ Ý C¬4 öf»»Þ$± ýGÀÍf þ± .Ï'÷½|ÇQ%(°S°+X'n¾ñ0ûj z ðFî÷eUÒllQé=7¤ÔÈ"0ÙüksË4èuF£g£º4izÞû k]è !âøF4G EÇoÞC¼Á¼þç4aà x ôÄu``W°ôÆâ`ì,DlôI!Ö0D2ÐÚB B;V -ãÄêe9®¢V ®Q>·uÆÔipd#EbtÀF4DÞù» MÒIõ ÁéEÒUÖ×´*´ áEH衱j¢:Å)ânÇSç µ }Ô:;; =ñÏÓ7Ìn.QC6¢I6iã9À£f¨Átu1 Eä.É) ¬ÁnÅE MÒ ¦!lm³é(>Âq5®¶]uhé #¡Ht4Q08T¢Ñôh rýf@ÂlÛ±mî=? Ð}Ãjó ïàg0yX«×ðÜWFÅyà h ¾W D`pNÄm'ÌDIðUùP+LoOÔ wXC¶úf¤®»;ÒÀ÷é¬%?øCFÄ>¼TòªÈò%÷b5ås[P¦Äßµ0 ÂZjøÄÆ ?°©h n¸M`½1~[G pÑKßûÇrfÚkëX«Ô*Db(8dø Ü)zpæ÷HàV¡ÑÅl>µ+ëè´Öi¬ ?¢gcöÀfªJøRê4Mäêj nÊ á 5"h i`¸}~î~ÀÅ>ÌàäK"¡ûe¾ßÏù~?éÂk&£Ç U³,×XlôbÌRWUOÚ¾¸l y0N \hhþRþ©.uöJ°Ð¾Hd£Æ%E«PîæWQ´ ÌÞþ ÀµphE_¥&Kg. ¥%/ÉM}8Ëbaá@þÜ :Îi¨ëKxUaª¯W n"6@'¦·ÒÎâKæj¤APØMÒu¸Hl0 ;*Ãè 5N1³@Ú$6 VJÄ£l}¸À·5ÊU0 éÃ|Á ¹ùÿ ¬XÉC cÛp¹=ÙûÁ8â¿ âÖ¸¯ë¬:?x4~óï"9 y. nB!ø ê¼»1eZ (h SiÐÒ¡Ù,pw* %Sk(> æZÝøÌ ÅT¦<xtë© XEÝSjéÒ?V@¼dÏúY£göfkíà ÒÄx)N%xÓYaq´º tèÞ«¦ÉÔR-éÑy±çÂX4w 5Ó ÞÍD 85³dù@X [ ÐY,í w ÐG¸½( ®fÜc§äɾÿ rꨱáuþqATcµ5g7¤èC 8 ¡ø»ª¥(Àì&ÜôX?L~&"ÞáH wï?Ha©ðÀ÷F OÌó. {t3×û|¸îÝ zíÿ 8¹z6èïM?Øxh¢æ #ѤS£µ@¼¨©U«¾¯qÈtì¼`%lpjÜ)Îãè¬4Ú?F0rGÀ;6GãNæ<=tÄ Iª:R ¨9TºÇ(@üA×¾cm§jJwEÐöÍ1þ2ÔVú_^M ¨Cè8_ϼPA<8³"T°HÆçJ ±@Ö§ÀRäbñ0o3ìÎ/« WÃõê7w" t*)\ ²/ø¨x~îPõâ68G>§x0|«óX_gã FÖ7Òa0¡AeÆcmËí_¬Úíà n @íØp¨-avZb¶Õ±!AØ?X=ON½Jàî0"Á ;NÄÓÏ.¹í4iÁ]:iAà oïæb¼R!zPCªKø?DTv+°jxéÜ£ {ó_£»ëCûÂoNî$³ ï{mÀ¹5ѼK¶+v)TúZë ×FD]\Nù·Â0¥ ¯Ð:¦-EÃF:É$òL Oyõ<Ågã>£6ÖT VíHË{?ó&óÜÐ:MAÒ¬3±Ü /kZÔȳNKfÌÙtßÞ<õ#é¨p¡¸ª~Quyÿ Xkõ×®ñ !N¶: ´¨+ aZÒkt˳p/zPÞÒRXÜ@{úUø2ëêêäõ=G½U¢Pów7§ÔF]¾HýÓ¶{Zÿ °«?x JÂ2°Ò+ ¦ ;i`1«¯YC¥¶ 1ó ;-C±4i! 4Bª´ UP]Ï19áþ`9g{Oð]Sö]åð¯eâ¶DÆÇPÔÝÉa¤0À¤dyjS» ôdÑÕn¡ K¯a мH&%© *ÿ ÚæúΠدgï:X«ë(FáþðwIZ¶ J¦À°ÀÄ|#©z ~±©¯1.4Û rbHgÔ#c¥ÄYA`i.#À£5.áï(;«>¶ qɧúDÔo)Âà§à@d ìg , ÒOÊAÎíÎPIÏð`|=A÷o ý`5v\}ݼ!_ Rn*h R@\é@ãZè/§n81( )â6ù%»¨-ø=>_:Ñ"ÅÙF¦© °mÆÆ9ÀT u¶X~¨N« SÛ¶6ËæR«RSX, 6 úU^)0[𵩽b,àµÃÂÍè N8s®Úèµãà(¼¡\AîÁÞM|Ü 04çÃ4ÏóÁ_5³ó·$i4¾d¸:64j&´` &¢åL ôÑLnèðÄæÙ:8DêzÆDBa¯wG0R©Ü#¹PjT¥UØÜDÌ TÙ®kì ¬îT/W p)Jªáah"ÅZóçë¬%ê×»oËmq4P!%© DÀC@ ÂFuvë`ß»åøÞ.Ì©ZD *×ý}ê¶2½Â<<eKUZ ôDøлÅÉóù*"ggxÝ)Ú èH½©NØó} » `©]5¥¬å¦=³,º¨. nÖëX% èpÇØ"àÃ:1ÚºDØâ²M/V¿³á´Ãm¸giäÏCû0ñÏ«5 c_¤iõíozßÀ 8b¯z0Ó³$%lc=éÍà¤]0¶1Èï®$²Ò/ ]mØ {? A-Ú)W«UUP4Ô=ä@P¢[H, û¹å£DaB!)Ûk)OÒVR»<bãô¡Öe¼´|¶à®n¨BƲ¯7¹<ää `&écܲ,Q£ºÈ{(Ô A]qà øENjµÕQÖȧ©WÅ^ ÖÛÐ £¦FpÜØMHÍl×g¼ÉBoÈvo@]Ϊh nîÅÍ¡A0 ÞÖ¢"SûÈá >¶õ5MBWrN¸@oT±Ý 'ô¢nÏSîòx?-ðW¸áQ¥,ý «à9¬Gö|àFbÛÞ`ÊYL¦ípP|8×ñ.Ë$( Ö*wöþó ëë}¼Á?·É .cª¬bSáÓèBÞìè ÂhkÓX6]JG k{Ôn3ZW/æ%I' Nã t ÀñÊ»°ú1D*Æ*Ð 6¡0&ÉÏÈÿ x )"µ²ßè0ü:øÆ~éƤW¨ÎY±FwÖ iôØ×âFUñyTy´ ]\h"'Îé7) ,¡ZBmäq\y kÔ?VdÖWUk@çÜ â¨$*Di[+ ( }1Ò%UÖð°"8è$U!V3ÆûT°]h+@'A:LãK×@©£UÁ!VhFDU²¬"©(í 4SEÁlÁ.ÛG^ ((:wÑÆ>çÐdBóþ²J'¯FHõmÚ5 f@» KÙ¢ 1¢I Uv«î4aè)ðdï\@ ^`T=ÔU1ÍÁ}¾4Ha ä±¹ k#§¡ ! ¤i Ö@pè,ÜU°"@ Ûè3P tÑpMÌ£Æ`g C,ob,éD×t)j¯ Áhðiùuc0S¢-mB;·£4ÍA¨XÊCø x ¨Q`¤Æùvº{þñý) ]_°%öß"_aGÇáh¨B1GäO» ñË?ÿÙ |
| URL | http://testphp.vulnweb.com/signup.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 296 bytes. |
GET http://testphp.vulnweb.com/signup.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/login.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6033 |
| Response Body - size: 6,033 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>signup</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h2 id="pageName">Signup new user</h2> <h4>Please do not enter real information here.</h4> <h4>If you press the submit button you will be transferred to asecured connection.</h4> <form name="form1" method="post" action="/secured/newuser.php"> <table border="0" cellspacing="1" cellpadding="4"> <tr><td valign="top">Username:</td><td><input type="text" name="uuname" style="width:200px"></td></tr> <tr><td valign="top">Password:</td><td><input type="password" name="upass" style="width:200px"></td></tr> <tr><td valign="top">Retype password:</td><td><input type="password" name="upass2" style="width:200px"></td></tr> <tr><td valign="top">Name:</td><td><input type="text" name="urname" style="width:200px"></td></tr> <tr><td valign="top">Credit card number:</td><td><input type="text" name="ucc" style="width:200px"></td></tr> <tr><td valign="top">E-Mail:</td><td><input type="text" name="uemail" style="width:200px"></td></tr> <tr><td valign="top">Phone number:</td><td><input type="text" name="uphone" style="width:200px"></td></tr> <tr><td valign="top">Address:</td><td><textarea wrap="soft" name="uaddress" rows="5" style="width:200px"></textarea></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="signup" name="signup"></td></tr> </table> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/sitemap.xml |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 250 bytes. |
GET http://testphp.vulnweb.com/sitemap.xml HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 259 bytes. |
HTTP/1.1 404 Not Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html Content-Length: 555 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 555 bytes. |
<html>
<head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx/1.19.0</center> </body> </html> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> <!-- a padding to disable MSIE and Chrome friendly error page --> |
| URL | http://testphp.vulnweb.com/style.css |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/style.css HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 343 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/css Content-Length: 5482 Last-Modified: Wed, 11 May 2011 10:27:48 GMT ETag: "4dca64a4-156a" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 5,482 bytes. |
body{
font-family: Arial,sans-serif; color: #333333; line-height: 1.166; margin: 0px; padding: 0px; } a:link, a:visited{ color: #006699; text-decoration: none; } a:hover { text-decoration: underline; } h1, h2, h3, h4, h5, h6 { font-family: Arial,sans-serif; margin: 0px; padding: 0px; } h1{ font-family: Verdana,Arial,sans-serif; font-size: 120%; color: #334d55; } h2{ font-size: 114%; color: #006699; } h3{ font-size: 100%; color: #334d55; } h4{ font-size: 100%; font-weight: normal; color: #333333; } h5{ font-size: 100%; color: #334d55; } ul{ list-style-type: square; } ul ul{ list-style-type: disc; } ul ul ul{ list-style-type: none; } label{ font: bold 100% Arial,sans-serif; color: #334d55; } /***********************************************/ /* Layout Divs */ /***********************************************/ #masthead{ margin: 0; padding: 10px 0px; border-bottom: 1px solid #cccccc; width: 100%; } #navBar{ margin: 0 79% 0 0; padding: 0px; background-color: #eeeeee; border-right: 1px solid #ccc; border-bottom: 1px solid #ccc; } #content{ float:right; width: 75%; margin: 0; padding: 0 3% 0 0; } /***********************************************/ /*Component Divs */ /***********************************************/ #siteName{ margin: 0px; padding: 0px 0px 10px 10px; } /*************** #pageName styles **************/ #pageName{ padding: 0px 0px 10px 10px; } /************* #globalNav styles **************/ #globalNav{ color: #cccccc; padding: 0px 0px 0px 10px; white-space: nowrap; } /* 'nowrap' prevents links from line-wrapping if there are too many to fit in one line this will force a horizontal scrollbar if there isn't enough room for all links remove rule or change value to 'normal' if you want the links to line-wrap */ #globalNav img{ display: block; } #globalNav a { font-size: 90%; padding: 0px 4px 0px 0px; } /************* #breadCrumb styles *************/ #breadCrumb{ font-size: 80%; padding: 5px 0px 5px 10px; } /************** .feature styles ***************/ .feature{ padding: 0px 0px 10px 10px; font-size: 80%; } .feature h3{ padding: 30px 0px 5px 0px; text-align: center; } .feature img{ float: left; padding: 0px 10px 0px 0px; margin: 0 5px 5px 0; } /* adjust margins to change separation between the feature image and text flowing around it */ /************** .story styles *****************/ .story{ clear: both; padding: 10px 0px 0px 10px; font-size: 80%; background-color:#FFFFFF; } .story p{ padding: 0px 0px 10px 0px; background-color:#FFFFFF; } /************* #siteInfo styles ***************/ #siteInfo{ clear: both; border: 1px solid #cccccc; font-size: 75%; color: #cccccc; padding: 10px 10px 10px 10px; margin-top: -1px; } /* negative top margin pulls siteinfo up so its top border overlaps (and thus lines up with) the bottom border of the navBar in cases where they "touch" */ #siteInfo img{ padding: 4px 4px 4px 0px; vertical-align: middle; } /************* #search styles ***************/ #search{ padding: 5px 0px 5px 10px; border-bottom: 1px solid #cccccc; font-size: 90%; } #search form{ margin: 0px; padding: 0px; } #search label{ display: block; margin: 0px; padding: 0px; } /*********** #navBar link styles ***********/ #navBar ul a:link, #navBar ul a:visited {display: block;} #navBar ul {list-style: none; margin: 0; padding: 0;} /* hack to fix IE/Win's broken rendering of block-level anchors in lists */ #navBar li {border-bottom: 1px solid #EEE;} /* fix for browsers that don't need the hack */ html>body #navBar li {border-bottom: none;} /*********** #sectionLinks styles ***********/ #sectionLinks{ position: relative; margin: 0px; padding: 0px; border-bottom: 1px solid #cccccc; font-size: 90%; } #sectionLinks h3{ padding: 10px 0px 2px 10px; } #sectionLinks a:link{ padding: 2px 0px 2px 10px; border-top: 1px solid #cccccc; width: 100%; voice-family: "\"}\""; voice-family:inherit; width: auto; } #sectionLinks a:visited{ border-top: 1px solid #cccccc; padding: 2px 0px 2px 10px; } #sectionLinks a:hover{ border-top: 1px solid #cccccc; background-color: #dddddd; padding: 2px 0px 2px 10px; } /*********** .relatedLinks styles ***********/ .relatedLinks{ margin: 0px; padding: 0px 0px 10px 10px; font-size: 90%; } .relatedLinks h3{ padding: 10px 0px 2px 0px; } /************** #advert styles **************/ #advert{ padding: 10px 0px 0px 10px; font-size: 80%; border-top: 1px solid #cccccc; } #advert img{ display: block; } /************** #headlines styles **************/ #headlines{ margin: 0px; padding: 10px 0px 20px 10px; font-size: 80%; } #headlines p{ padding: 5px 0px 5px 0px; } img { border: none; padding: 0px 10px 0px 0px; } input { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } textarea { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } table { background-color:#EEEEEE; } td { background-color:#FFFFFF; } |
| URL | http://testphp.vulnweb.com/userinfo.php |
| Method | GET |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 288 bytes. |
GET http://testphp.vulnweb.com/userinfo.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 429 bytes. |
HTTP/1.1 302 Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 Location: login.php X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14 |
| Response Body - size: 14 bytes. |
you must login
|
| URL | http://testphp.vulnweb.com/cart.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 372 bytes. |
POST http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/product.php?pic=1 content-length: 19 |
| Request Body - size: 19 bytes. |
price=500&addcart=1
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 373 bytes. |
POST http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/guestbook.php content-length: 33 |
| Request Body - size: 33 bytes. |
name=ZAP&text=&submit=add+message
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5393 |
| Response Body - size: 5,393 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong>ZAP</strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/search.php?test=query |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 367 bytes. |
POST http://testphp.vulnweb.com/search.php?test=query HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com content-length: 25 |
| Request Body - size: 25 bytes. |
searchFor=ZAP&goButton=go
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4772 |
| Response Body - size: 4,772 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>search</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>searched for: ZAP</h2></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/secured/newuser.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 376 bytes. |
POST http://testphp.vulnweb.com/secured/newuser.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/signup.php content-length: 96 |
| Request Body - size: 96 bytes. |
uuname=ZAP&upass=ZAP&upass2=ZAP&urname=ZAP&ucc=ZAP&uemail=ZAP&uphone=ZAP&uaddress=&signup=signup
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 733 |
| Response Body - size: 733 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html> <head> <title>add new user</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <link href="style.css" rel="stylesheet" type="text/css"> </head> <body> <div id="masthead"> <h1 id="siteName">ACUNETIX ART</h1> </div> <div id="content"> <p>You have been introduced to our database with the above informations:</p><ul><li>Username: ZAP</li><li>Password: ZAP</li><li>Name: ZAP</li><li>Address: </li><li>E-Mail: ZAP</li><li>Phone number: ZAP</li><li>Credit card: ZAP</li></ul><p>Now you can login from <a href='http://testphp.vulnweb.com/login.php'>here.</p></div> </body> </html> |
| URL | http://testphp.vulnweb.com/userinfo.php |
| Method | POST |
| Parameter | |
| Attack | |
| Evidence | nginx/1.19.0 |
| Request Header - size: 368 bytes. |
POST http://testphp.vulnweb.com/userinfo.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/login.php content-length: 18 |
| Request Body - size: 18 bytes. |
uname=ZAP&pass=ZAP
|
| Response Header - size: 429 bytes. |
HTTP/1.1 302 Found
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 Location: login.php X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14 |
| Response Body - size: 14 bytes. |
you must login
|
| Instances | 74 |
| Solution |
Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.
|
| Reference |
https://httpd.apache.org/docs/current/mod/core.html#servertokens
https://learn.microsoft.com/en-us/previous-versions/msp-n-p/ff648552(v=pandp.10) https://www.troyhunt.com/shhh-dont-let-your-response-headers/ |
| Tags |
OWASP_2021_A05
OWASP_2017_A06 WSTG-v42-INFO-02 CWE-497 |
| CWE Id | 497 |
| WASC Id | 13 |
| Plugin Id | 10036 |
|
Low |
X-Content-Type-Options Header Missing |
|---|---|
| Description |
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
|
| URL | http://testphp.vulnweb.com |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 238 bytes. |
GET http://testphp.vulnweb.com HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:51:59 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/AJAX/index.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/AJAX/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4236 |
| Response Body - size: 4,236 bytes. |
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>ajax test</title> <link href="styles.css" rel="stylesheet" type="text/css" /> <script type="text/javascript"> var httpreq = null; function SetContent(XML) { var items = XML.getElementsByTagName('items').item(0).getElementsByTagName('item'); var inner = '<ul>'; for(i=0; i<items.length; i++){ inner = inner + '<li><a href="javascript:getInfo(\'' + items[i].attributes.item(0).value + '\', \'' + items[i].attributes.item(1).value + '\')">' + items[i].firstChild.nodeValue + '</a></li>'; } inner = inner + '</ul>' cd = document.getElementById('contentDiv'); cd.innerHTML = inner; id = document.getElementById('infoDiv'); id.innerHTML = ''; } function httpCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetContent(httpreq.responseXML); httpreq = null; } } function SetInfo(XML) { var ii = XML.getElementsByTagName('iteminfo').item(0); var inner = ''; inner = inner + '<p><strong>' + ii.getElementsByTagName('name').item(0).firstChild.nodeValue + '</strong></p>'; pict = ii.getElementsByTagName('picture'); if(pict.length>0){ inner = inner + '<img src="../showimage.php?file=' + pict.item(0).firstChild.nodeValue + '"/>'; } descs = ii.getElementsByTagName('description'); for (i=0; i<descs.length; i++){ inner = inner + '<p>' + descs.item(i).firstChild.nodeValue + '</p>'; } id = document.getElementById('infoDiv'); id.innerHTML = inner; } function httpInfoCompleted() { if (httpreq.readyState==4 && httpreq.status==200) { SetInfo(httpreq.responseXML); httpreq = null; } } function loadSomething(what) { getHttpRequest(); httpreq.open('GET', what, true); httpreq.send(''); } function getInfo(where, which) { getHttpRequest(); httpreq.onreadystatechange = httpInfoCompleted; if (where=='infotitle'){ httpreq.open('POST', where+'.php', true); httpreq.setRequestHeader('content-type', 'application/x-www-form-urlencoded'); httpreq.send('id='+which); } else { httpreq.open('GET', where+'.php?id='+which, true); httpreq.send(''); } } function xmlCompleted () { if (httpreq.readyState==4 && httpreq.status==200) { xd = document.getElementById('xmlDiv'); xd.innerHTML = httpreq.responseText; httpreq = null; } } function sendXML () { getHttpRequest(); httpreq.onreadystatechange = xmlCompleted; httpreq.open('POST', 'showxml.php'); httpreq.setRequestHeader('content-type', 'text/xml'); httpreq.send('<xml><node name="nodename1">nodetext1</node><node name="nodename2">nodetext2</node></xml>'); } function getHttpRequest() { // free the curent one if (httpreq!=null){ httpreq.abort(); httpreq = null; } if( window.XMLHttpRequest ) { httpreq = new XMLHttpRequest(); if (httpreq.overrideMimeType) { httpreq.overrideMimeType('text/xml'); } } else if(ActiveXObject) { httpreq = new ActiveXObject("Msxml2.XMLHTTP"); } httpreq.onreadystatechange = httpCompleted; } function SetMyCookie() { document.cookie = "mycookie=3"; alert('A cookie was set by JavaScript.'); } </script> </head> <body> <table border="0" cellpadding="3" width="500" align="center"> <tr> <td class="bordered"> <a href="javascript:loadSomething('artists.php');">artists</a> | <a href="javascript:loadSomething('categories.php');">categories</a> | <a href="#" onclick="loadSomething('titles.php')">titles</a> | <a href="#" onclick="sendXML()">send xml</a> | <a href="#" onclick="SetMyCookie()">setcookie</a> </td> </tr> <tr> <td> <div id="contentDiv"> </div> </td> </tr> <tr> <td> <div id="infoDiv"> </div> </td> </tr> <tr> <td> <div id="xmlDiv"> </div> </td> </tr> </table> </body> </html> |
| URL | http://testphp.vulnweb.com/AJAX/styles.css |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 306 bytes. |
GET http://testphp.vulnweb.com/AJAX/styles.css HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/AJAX/index.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 341 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/css Content-Length: 562 Last-Modified: Wed, 11 May 2011 10:27:48 GMT ETag: "4dca64a4-232" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 562 bytes. |
body {
font-family: Verdana, Geneva, Arial, helvetica, sans-serif; } td { font-family: Verdana, Geneva, Arial, helvetica, sans-serif; } th { font-family: Verdana, Geneva, Arial, helvetica, sans-serif; } a { text-decoration: none; color:#333333; } a:hover { background-color: #FFEE00; } td.bordered { border: 1px solid #CCCCCC; background:#FFCC00; } #contentDiv { border: 1px solid #CCCCCC; } #xmlDiv { font-family: "Courier New", Courier, mono; font-size: 12px; color: #33CC00; background-color: #000000; } |
| URL | http://testphp.vulnweb.com/artists.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 287 bytes. |
GET http://testphp.vulnweb.com/artists.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5328 |
| Response Body - size: 5,328 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class='story'><a href='artists.php?artist=1'><h3>r4w8173</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=2'><h3>Blad3</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div><div class='story'><a href='artists.php?artist=3'><h3>lyzae</h3></a><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=1 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6251 |
| Response Body - size: 6,251 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: r4w8173</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=1'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=1','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=2 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: Blad3</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=2'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=2','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/artists.php?artist=3 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 308 bytes. |
GET http://testphp.vulnweb.com/artists.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6193 |
| Response Body - size: 6,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>artists</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>artist: lyzae</h2><div class='story'><p><p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p> <p> Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenatis. Aliquam posuere lobortis pede. Nullam fringilla urna id leo. Praesent aliquet pretium erat. Praesent non odio. Pellentesque a magna a mauris vulputate lacinia. Aenean viverra. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam lacus. Mauris magna eros, semper a, tempor et, rutrum et, tortor. </p></p><p><a href='listproducts.php?artist=3'>view pictures of the artist</a></p><p><a href='#' onClick="window.open('./comment.php?aid=3','comment','width=500,height=400')">comment on this artist</a></p></div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 284 bytes. |
GET http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/categories.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/categories.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6115 |
| Response Body - size: 6,115 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture categories</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">categories</h2> <div class='story'><a href='listproducts.php?cat=1'><h3>Posters</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=2'><h3>Paintings</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=3'><h3>Stickers</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div><div class='story'><a href='listproducts.php?cat=4'><h3>Graffity</h3></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. Vestibulum condimentum facilisis nulla. In hac habitasse platea dictumst. Nulla nonummy. Cras quis libero. Cras venenati</div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/disclaimer.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 290 bytes. |
GET http://testphp.vulnweb.com/disclaimer.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5524 |
| Response Body - size: 5,524 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>disclaimer</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">Disclaimer</h2> <div class="story"> <h6>Please read carefully</h6> <p>This website is created to demonstrate the abilities of Acunetix new product <strong>WEB Vulnerability Scanner</strong>.</p> It is not intended to be a real online shop. Also this website was constructed with common web programming errors so it is buggy. <p>Please do not post any confidential information on this site. Do not give any creditcard number or real address, nor e-mail or website addresses.</p> <p>Information you post on this site are by no means private nor protected!</p> <p>All images on this site were generated with fre software <a href="http://www.eclectasy.com/Fractal-Explorer/index.html" target="_blank"> <strong>Fractal Explorer</strong></a>.</p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/Flash/add.swf |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/Flash/add.swf HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 365 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: application/x-shockwave-flash Content-Length: 17418 Last-Modified: Wed, 11 May 2011 10:27:45 GMT ETag: "4dca64a1-440a" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 17,418 bytes. |
FWS
D h ¸ 2 CÿÿÿÄ ÿÙÿØÿØÿà JFIF d d ÿì Ducky < ÿî Adobe dÀ ÿÛ ÿÀ B k ÿÄ !1A"2Qaq3B4RCðÁñbrÂ#5 !1AaQÁ"2ðq¡±ÑRáñBr#34ÿÚ ? äRp«Ãáð£$GÓ4M´ÞY¼Ï¶AúEíð¯_eBk39<E~wN>S lï*³6º¿[jmÔô®è÷±$°=¨î'~Ìé´r=¹Ác<mÈçbÀ|Ë©¸éo/×áQ'GE o-ÊæO<ñ»³6ê ÞâÆÀØxR@ ¬J"¤ µ4#x£i Q}Ll5¯Ö¶1Ûâ¸5\®Jï `ÙÊóz|×ðªsÂ+â$ÜÎ^Osñ6ÆÐS»i&;ZìÇRõʬÂ3Ó,kõåÈuÀPä½ç˾;c ®¬²-{±7 ËkÛJëV"i-y¹³æJ%áB Bè [©ùÑ$jÎ aóç| ÅFÜÊBdª¨ ·î¹ÆÈ<¨´ $°ý~¶¥;)º¦Ó Føì 8æA w#$àoRä("àÛÆý-Ò°Æ¥Ã*ó {É8¢L|`5/iñ õotBÚBlV4¤ÖÕ̵*è´"Î+3LªÍk7 +dMöÿ #qá&\3ãN ÆEÔNå#qÐá¿qE©´ðÃ/dRBï¹½®°&Ç<) y¤oµo©í^®7ÉÑÐG jÐjXÇ/hq¿ 6~XW ® dBý'ÆÙÒfÄáîiÏ6Ùý¯§h SÔ ¨ÛJ:@a.Ü °í9bK H7oùÖ U·¬F.7·cÈxÏäwDqu+oW×é[ëïSI!x±=».^dE!qÙM[[êÿ :iÏJè MÀ )#r¥XuS¡i-M px8¹sÈÉ\ao#0$HÚKP: ÇHp ¤±m«4ø¥c`LlÐ8¸¯Ô^ªF²ZÏ/Q¤ êás³\~7Ù»Ý ¡²ÞÇ[W£fô^²Ï'B¾ ÛOvyí? Tk)cxVue`N¾J×=¶0÷1ʾ"âqRìÅWef ÿ H¤îVÿ Nº[OãZEñb÷nN´õ ÓÀ'²reiò¦·ãâÄv°`Ö%ζ饺Ñ''äËÆrY t2db®á lË%e$þ¢|·5çÍÎÌ £Þ¯Æ2)Qó8ùùnl ¬éÿ ¯ÕµÛ`nÖ½c±ÞÖO[Xñáî¯ó ¢UÌö¶2çãO?(H {nÐØ ~Ûç÷ZXÍÖÝíÖMÿ rdþft¨ªÄ! è7×¥uÆ)!»FõTháÊIcîƬ G{>¤Ö:/·ùLçXÄ,5 ²°®¼5æîí(A´ûùªòƨ¼@üûrØnP¼íëbM>]Ä~ªí¶á<U"ÑîbN¤ØG`üèr¼n WSuaÔà¨Y$ßÆ´Ô#/MH ãwGVBU¬4 Ö,GBöäðü|Ù/åIgÃkÄ£¡ññÐÖ7Q^ #E¯oryü¿";±»ë´í:[ëNöptKøÅâùdÆÏ~ÉVnÓ`àGJÇʵZæ»GZæOc%d¹ß2âØ¡-ãükG¼M× @´³=§Ù®1ãã°H÷7¦4'Ô|/m/[y©.öx!P¥Ät>{:<Äw7B 4¬éêð*¤\Zÿ 1^_©©¸5 xýù@ÏxÇ >x48æ÷fÛ¬ú ¯O£´áLðÇ´SbRá/BMµé^ßøvnÛ^ µ»vñèÝ~çÓ¹¿wyÓ¯ ,çÌQhDÕ!*âÀ·?%:$rHY# FºY@l?bÄà½Åvó% ´nX«\ Ûám5¢pÔÕr Jø<¯k-gÀnüíW%ULtN;LÎ%eÈ [ã ±»lò)Ý´m: ÿ :ñ÷Îj)âño ke©y>Ö[6Ê°d ¬ðÃAqáNÙJÚW ~-·^1çÌm× o³Ñ¹êê7ocàT\)ö5Õ·õ(\}¸Pmã¤9éÝX¹ÓÄèß);RÑ£cÜ°G3ÂcÛ»¶¡Ê®ÝmòÒ°ô½^Jmסæ9æWÄöÄ]òre# .ÂÍ{ «þ«ÑºõÙ0öèÁ°¿ühm·{ôö¯ó^Ý:V_ rÃ>¯ÕñÀ`ª@MR´#aZ¦¬Noô«_ÊQ % ûjz ô¥¥ 19&aËiuÍÝÖ¥[° þì3"ÆÉå/v æÓK ¯;ñpUqÂTÁ®JÖ¸Í:ä ¹äѵµðS¥þÇ5{mi©µ8?QJ¹8øèÁå +0 µ ¿ßXm'~vT-ªS2¤xßÅìfW ªK2ùYÒÍ¢jæQ] ÇY× íäN°oü ~Ñ7z7n>åéÓo·üL>^ß?±:ÙÈêeR5hD´U 6X£'Ãh"ì(o@ø '29+ïdýD|@ùTNâ +ÅÐi | ò²GknÓ®k\[ýï°ñ2¡²dÇÀPB5]êÄ ñ6¶ÃfÔ÷W|É?ñðJm%Cc Øf\¹BA`- !õ[AXî%ûKúâë«ÒÔ¨Åîohr6E¹ÕÖ¹ø öö» v Hͪ:ÿ .öí5û¾×kíúÖúI"yæÕ¡*ÄH«@HëVl:Öx?ø²þ×Ñ£ïz_ñ¨^.<{ óâÚõ¹öÿ êùUÏ'îõÃý¦û rOO§¨ôü«uÏ8}~½%Ä/û?ét ÷Wμ¿Yñÿ W ü=EÛ{÷cîu>®|?ƽ?Lÿ Zðõvs2Ï·>Ñé×ú¿k§êþÝ/\~»J´NwÞýïzºkVö?ò?w Å/[ú£÷ßöRáÿ ßn±}ÏÿÙ¿ ' h ¸ A Ù@ ¨\)G²ô5±Ø Î( ÿ @ i @ ?> ÿØÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÙ¿ ÿØÿà JFIF ÿÀ B l" ÿÚ ? öúF@ßÃíKJµóÒòVKTeÛµvÕXtø-£Ùiz*ñÅjTrV&Vå1ï,b¹ÛçƯ±·.ïQXz çê s#nH×÷i·2Oò®²Eùª6ÿ ã´Âé k[¨î6JÜI2¹Ú·c= à<}a4ë4v¶¿e¸¼ ø \ýÀ»¹'þÒ½¶e 5bêZ}µÎç¶÷²òªØÈ°8!>WsHUå1ã¾X®d²³Ö®Y®£ lDF>T¿6á(#¯Óýî1õ«9µ[rÍÇxÿ Ãw³NìÒÇ@ª?\dz|§£sËð ȳ}:ææy/m[ ¦ ,Ý÷¹ÉËu'js[ö6«R¤wìzL×8Ùݶ¨êzVk)s}{k÷~Ìá>VÎàȧv8Ç'§ãX>)ñ ¿=Q]E°IGæ 7d O\/5æ~ÔukýBêÉ/- 7!IYÀãÉñü>µPù'&ì°®Ps±Úk^4´mN%uŲï=ÀxÉàò1µ³í:×?iâ fæÖ¢Ñf ï Ç$ ú×M¢xßNÕgÔMþjðÄýà3'¹Ýþ úw¶ ¥ñeÇú«2ëÈÏiõõ8éT¥Iirý¥%¤c3ß©i)k)ÊAQÌÔæ; õ®jÿ a¼±ÆÌn ¡;x@Iü1YHÒf S©¾peÏçøU RìÁo#¬m+ùf}êCÈíqÊÒÛs#`ýkÄÄzeMò» 9 OÝnäçûªsÿ ë®R v1â-ñÉ"ÁyÏ$R².Ü ïædäjç|csqâØ®à´ÝkclÁÍän¿yxï /s[B¼¯±Ñ ^òçØé¼Oâ«M-müé1çgiÇçÎ:÷®ùu©5XuíMYZܺGæHÊÝ ±8H×'¿=+¯ð ¥Xv$ûB3owÚA,í¼ÏÐ »ã 2Þ}*H¥¹ÍîóRM sØÀ=zVa.XësHJ¥Ë nPм+ekr÷4³Ê4²¶KNݸ_øp[3M<{fIæe,ªk1=²0xïÏ·JÂøy¬ÛÃ¥XiÓùþr-˶U1LoÎXaTdóé^ nZί<[LÆ·<esä·Ãí;Ks´×êZÄ`9PÎì¤ã¾úýpx¯Xhw/÷k.OÛ;³JnYØä)ééÒ¢3²±HZuqzWtÙ¼¹Í,1æ+yß(?& Î3Ïqצ uKp$]ËÞêo©4±~õqZÅÎâ=.ê [¤Æc/¼N9ÆAáô5¿¬]½µÓE Lè¹òÑ[é~¦¼Äú¦îÖÞûIÕ¥c&RelbS°®í«s³Üuªpæ*9ßê %¥ÒOñË»?3Hp Ü@çÿ {-»5 õë¯,å[¹|N-·³Ñ6Üw=;uÀxkÄnÔõdÒYRîêPåånmE-× Ü=þíwð woª^/©l cîi>| -«ó +ICó3IÁSÏ:ºÐneñ<Ë"©5XªóÙ9|_N6ÿ v½OÃ62ùwÞYÁåÎG>T»6ûñ·ÜD «ItÍòIÃr2Ïüæ¶-l¢´µ#Ùjx p°©W%bg_Y|«÷vûÖ4mJݱ£K±Ò9:2ëµ±éÚºÉÿ Í\F½¼· ðÜتK#±YHùTüÇ¡<×ÐVqõ3{uá-×Kñ ökök¸z ¡È ¨X ëÛo¸ÇZök6 ¸ÝÒ¼'VñCÙxÚxWÌâ#2Bì]B°ï2 sÐf½3ÀwOåÇ Ùu½K½ÍÆâIç®F{ qþÍtW²:1J£;¨×wûµ&ÑN>]µ6Ñ\§)çßgð×U-®îë/1E%ÉBØNM¿»Û[Ñ$*ÿ w=ð¯-ñ^¾ºeuo$ðMÜ m»*L² ùO9}cÄãOµò-¶Ü_yEÄ+÷¶â>§¶^Ó¦åcgVñM½µ÷»ý $-)ÚÛ³W`ÇÎÍÓ¿ zrÖú¯nd{OÒ¡ÜÒÚ Òví#æLc¯iáYµ=_KÕnâ¹Gºig;6ÀmÙÝ´«çiàäú õ(tÁ nù Y:~¦jå;Røw<OHðŲYÚÞÇeæ=Ä8F\ 6ÖP \æåxÇjô øp[-C@½ì2 A.é«Í'Ìwo#×òè_fµ¾¶»o´Dn¤u- ~ê÷ søôãÖizt6qÛ[F©|*/G ¢u\ºë9u [U²®l5&ï÷«£2µ«XÁ{ÉÕ]CgÓ OR¶³º·y<§¸ßånS*Û»¦psçô5ÍÉâ;9u;«Xäÿ uRÒ3 ¹lü çï ÷ W+ì ¡ç'ÐZ-FÊk¢ºin±p7,a"*Ë·áÜyÝÛæùzï h2é±Ô'ÎCo+¨2>ç ( ÿ ëÖıÞÚXj¿o.h6nkºòqΠºK=Z +H îî%bZ<Èüpü«iÉò$tNs;º«V6Ö^|/|ÅòÚ&NθÜLÚ À®sÇÍ^3×Ç J»Z v(ÊH¹Nq]'IVÔÚsæ0_Å8çß(®É|(îÂY²âLîQÍlAË(<J(®7ñ +r{pP Óð«4QB% QIü4QAG=âø£LXæE9 Xd0*sÞ¼ðÔuä` .«=ýªUÆ=6¢¢¨ì(¢ºèìÎÌ6Ìд&çJ»[e_¶¸ÃüÃsëô{F;ß ]Gy\FjÊ¡Âî ôÈàúÑE.£[ͦÿ «_úèGà«EÊq½ÏÿÙ¿ ' h ¸ A Ù@ ¨\)G²ô5±Ø Î( ÿ @ ?v ]ºG·" ÿ 2 e K ² Ë å @OÜS!! /r«é¯¦½C£ ä¨SQ _^àyíY²0@*¹jÀHwÓ!^¯ ò+és©#©ëÈó¡ ,ò«ép&Á@§ ä¨SS `àg½ò¢MUËP¦ §@Áÿh_Lª |uáÔòÃ. (ò«éqÎfÆ9°ä¨SWÿããå»Çn]É´rÀ-ùjÀçXó ã¨r+é Ìs¥©Ö¦33 HåWÓ $fMgrÉP¦· ÍÍË6pß-BàÏ6c<ÔE}2 vʨ:Ø cc`ÎU}0fQ¼ÙFÖ k0 ¬¬ö¬Ú |µ oûC|©²S@yôÈeÖ¡ÔßÆ19ÐiV ÿ_Jý5²Ó[%BÿOO-N4å¯PNZ (+iÌ[¦È¯¥xZw¦þ?RùUô ÖU-eQrT)b ¯[-Ô¶ì ËP¥UyTÖx_Jßú¹USq#PÊ0üªú_íí'Êi@y*²Ùµ/ ËrÐ µ PSÚ=à9ô %GåT N|^Ñ1y'*¾DÂló ÐJ 5à|^[ÀBå¨SÞèLa ȯ¥{ýré8ëEß_L «{6å`%B¨=í6n0-B¬ócÌ5` E}2Ñ®Wy @?ì TtßH àÌvÿ²a²Ô| «ZÿÿàÌvÿ³»%à¥ä rBÿÿ«Zÿÿ«Zÿ²^1ÐÓ «ZÿÿàÌvÿ 0 ¸òyÑ©WèǪÖW â oलKCýäb ,ã83YÑ« +ÖZlø@åÃÀÄ8TIÅ£hÄ¢¼-d ×±Ú:¥|p_K²Kþ;©h¤·PÉY% õìvx´ å,ÂË.ø@ ±T Kù@ «ZÿÿàÌvÿ G]iॻÿ9s æ3&e2a TÌèÆpxa©@]Ñ\ùî| ÿÿÿM ÿÿÿ3VFáy´UÎi!ÙLFæÒËi@úASùz)"uËÁ)æSRf»}sÛtÂ;Ëò×òþåáói«2Ac/},cÇÔ¹Ì Fjñàß ÿÿÿÿ ÿÿÿM «Zÿ GUháùVt,_9¤¥õ u®nl_-0à:{1õ|>:% ø!¬Ëb>K>i¸AUW`vl³Â2 IxãVD¬8¬÷F £ÙOÐÏò¦Y· Ò ÿÿÿ& ÿÿÿM J:ðÚo¢;Å1¬ þ6yÖ©l/RÑá\ù%Ò©ÇR¿ Ótø Xex,T!âIkV·×ãr:® ÏI Êø@ ÿÿÿ& ÿÿÿM Smbáý7OÉ¥WÈeH" $µkp9 ~7#ªâ øôéL£ªtªMôGx¦2ÆÏ5ºÕ-eêZ<" Ë$ºU;á ÿÿÿ& ÿÿÿM UöÚhF8¦7 ¿Ò?Q³Ö¶´Ô²Ñ¡ ^_I4nuURÁ Ó:X<^ hyWk[WøÜv5¬ÏäI£²® ? Á Arial _ À  â `¾g{ªÛ:[iwós÷! 9ßp·Ñí j ° 3 û 6 µ Õ ã E X £ [äGæþEe¥×û 5F]w4ðSµïvµÐ(6Ý;¢ 0¼ûCcË 0ª¹2r 'JWÉ>n×v 7T|~fR0(\ ÙØhÙfØ BDOßçºlÄl3ì¼oô£5$£º'ßçºlÄl3ì¼oô#5% í÷å{6» {Ä´½ËÆÍ®â_x²U°¿¨ÖÜOoʶ7õÛ û){[ûk]Ä^Ê^åQ«±k¼W+ܱïêµv-AQsvî'w©{-ýµ¨ /óWfkß}n¹jêÅ>n »«]ó¤ JPÜ7 ²{F¿-]kK¢¨ S P"bÌ]°³ï«WQ®ª¹ÁËæ;1 UÛF /yòK%Nü( Õ¡¹U6nSF¥r@ æ ]Ä?úeoRX+ õZY1" ¥ ¸ÑùM zOv OV¾QYå?F)º8úxQ `òéæ ²'É£%,dPÓL@& ]Ó2HÊôkÐ Lùµ3'0@V6*¬·Àj;7HèlÀâã²8¨Ç0·À=<êÇx [!¾fF~l$óÎ bØ¡n©0>TÅ)`"ÌZb Á0îÚFW ^jgÍ©9µgµ¥¼QÙºG@f F ±Ô %F ¶9 ¸À,æ ¹êäN;à0@ O?Uef ¤ /&Ê ³ð³*bÌ}igGáv]÷ _øÓBcLôà À ¦0. @ iº·¡ò¨66ÕÑIº5Ϧ3C@.Û6Vî5æ ²WWIfP´iF %¶Ayt @%9I%u¨^ í}ng5¹g9,¹K(LF`* óʯ9« B$Oßé»ìÂì3ì½ïô"u$ /ÆkZ,Ø)ù æ`y9`W ö7ìq"÷%ÍÖ¼ ½8âxl` 'öÇbþt´@ªnû^+½úûV ËÏ¥¯ó6;Î CóOÓf?[/` `ÕvÜÌ 8H)7µ0öÂFßWÉùú¶£Í+0øѺ&¸æãØÙ¼m \Z³ \ôí äÁ HÝîN6k7³ ]ÖFã eSrsºÉØ« ` }i@9Ø]ª×ÔæmФР"'fÙZà» }m oÕ¡[ ùböØ· A]/~ ìf°5Õ×U@W`i«f ,AE ¶pÊO?,²l²» ¥0í'Üi ,ô¼à ¬y*§Jø¨¸ dà _[-h°@K¶ôH`® Kðئå¸rß?0ü²ÏÖ ³S2^éÎl®'¡¨ëp hÕvU¸!¹àRSЧA7gyâ¬yUG6P\Õ¸@&¿ Ù'dm ´ÁS'ÙS d´ LÔ zw1ñм nU.åuͬ_>¥¶as]¦< @ "¹ÿjפ ¤R¥DدÀ,©1f ü !W±-ð@k+hUwW@bv ¥:ö oßY`.¡tÙ m7Â4ÇYÓ ç+Jð#R³4md¦e(ùÓË<âó LH^ 0Ò ×HR P `cÍïK JXݨðX[5¼Tøa' ÛØcÙSØÝWìS¥.þá¸ãjVã "ºj÷ÄÁh¤Är¦FØÈ ¹óçWÌg«§6®¥Ðµ ])-Ò{m¬õâ#Ðü fÊ·¹¿°Å I$f $9f cÆIåfiÀ °r=èð@ gúëöÓËÒ^ܳ(µ@`1-Sú MÎwþÝ*ëôJ¿C0- !L~ Ó0/ä¸Ì?6aðÒ 5³îu à a;?2-c ÊÀ3«`¥ âå(©yRNW Ò§HÆ` M}IlTX`+,T° `ÆÁöj¸ i®¯ 'ÝûH9¹W>[v(æª ö:cÈä[. d E¬çF¼¶¥Ëh¹,²¦9É` èâc³ @3Ê\©e XÆb3I¯P&¾@ P÷këð .I4&$ÏCïÁX£»Rh ¨P¶+@pJø zô·¯M,ÀËyØ )CKe II$HRT «Zbp /õufÔÖ¿ Ê¥¬¨ü #¿j¿Ä¢Þ7)ó J¨ý²ÚS¥0(Ù@$hÝ.UtMËDÜ R`ßM|)0äÈ7`$ ÌvL>8| CÎ FxJq)âÍY^5PVÙ: µX *ja9,õô¥N0 b ¨Æm3éË%Tð _ SVb@ , Bì©ÙØfÙgØ 3[ Û,Û@ BÜ©ÙØgÙgØ `3[ û,Òs± »T'¯=© ÌÚ% -I AÅÙ¬âóf{+<gò{Pl¬ñ³ hw(ø!ÍÎeP¡ÞaÁlÖp<* h{`xÃF~Í?`ã?ì[4ü^c7eP .ÊgFY@K fBãb=¨82¯®;<Pr^̵ìD,pRM´Iè¶Ö`Ù£ìr&k @: ìNP 5(¤¦üë\g2f,KèÇöÛ ¥Î ÙØfÙfØ i×å¾Áyl®Z+f¶lÒ¦åÊ ¿Ä¦ÂbÍ^ØrU`9s«¶Ùì,ñîý¾)Ñ«TjS)° ðÌs°C{1 èÄÀºÖójÜUêMW«44Xù¼ÓæÙlóe³ :Ì ôj³1ªÃ)\Ì¥O@ À¤Ë ; ræi ¼ØFÕdUD M"EÇ5%ö<×ØÛöÓkPIÌ e#8öòpÜNpÜ( > 1ÌÆdrË1°4àhá5+, ·kí%ZílgìX *TòyH ¥BP ûå?¼åùN_%:RS@Mój[Öç %ÈC*Is$àÒ^ À+Á YæFi ÃO2X·v$wêä\ný{bdVãç~Îk6í'~$ÞHüè»õíp ` ZGĄ̀ f/+2ÇWJqpr_L¹M32¡!|Ä àg©lº`1.m àºQY+î'ö®|J©<ÒÎÌ .nÉ.üûmöܶî·AJ³U¸·Ú ù* EùH¶GÍ(ì .ʾ¼RëÃo¤Û~@m×à ikö°ÍÄïb5üpÑ Ú[gìÒͳH/0qe\ÅJ:(j0LÜ q2YÀó.Úy¹ì3öæÐܶ ° ¢lrIºQ f ] Fmäc¢40 @tf8Ñ£Á à ZG¸ýÞÊürÔÓ ¦Ì8 Å0j Ý EráUpÄ· M¶(3÷+ Vâvd¯)Tó1TwÆO¶`ݼ9mB®m Ë7*0 ZGȶUø$ý×-²Á5n¾¸ -nKº ZGÀ÷ì«ðN[®>ce[¨áSv'À M5ÃÙªâÿü(×6³ZØ M(Q¥5FLÚu JÒLYF©§2¦pÉà#S LJ\&¶ b^3àF [e§¶@ ¯3Å% Sq!à¢nD@ù¦!BA $Wà hæù7o @ ZG°ÃÂð/¼6Ã*ÝØá©ø(>gb| ZG°ÃÊ·v'À !éj¿¤Àò>Ä©@á#w ¢±Ãì0ð¾ .uK¥Sh ßM>6nH ` ZG°Ã¶q[)MÄ'1)â ¶7ݶ!×uý±> ` ZG°ÃÊ¡ønØ ZG¸æ+>Ò6ݤñ\Jø qÊ·v(¹lß>Vv*yòË!Ê6( À ZG°ÉÌÀ¤[°»Ê·v'9çûÊ6(À A7J1fg1f` @fQ0+W\º`ý5´Ö+K¦®- d»:jüíjµª'ð@TKS³rlÈé6#ÙÎGÙ.S Sñ^ÍÃ{¹66Ý¸Ó ÈóíÀ6 à ZGÀío°¦¥HdºÙK. Ú`ìDø¤ rÂlO¢ÂÜ_L¼ O»1Fè )iÁ.öºí¦úÜ¢p À iïÙfC.9ÛÈ5%ÕåÓ NWèM_¡©S6¥HÀeóS©iL£¢È30ÊFjó+ 6Ì ·Ê7"FI¶ \ÚeAsrùÊ» ` ~+鸯q·&ÅÛ¸ Lå*}Á( #&GMn Û%¥w=¢÷@ ZGÀ¢ÌÄ f)+2J} 'fMk, *rE J©:g{Ð }mùûFÛ©½sç맳\¯» *.Äø*,¦}ÆÈ`¾R¦äO¥1 ¹( ¯Íµ½^¹Ýy "è¯jçÄ¡G)lJȳภ«|ªøÇ)L`/JöÌÒìÍK~û÷ri¾~©feÍ^\ÕÀN%?Aîy9Ò&R >ñ¤Læ!3AÛF7ÅÖ®ìÚ»`T lËa ²PpÌÃNãs; L<<[)õ ÊÝæßgìØ#¶@N ^ñÍ{ǵ6Î/õ¾ HPå¯[íD²¯¹åPÛà hÂöxZ¹ÐfçA¿)ü¦Xi íɯ÷y/fä¼ á6xZye"µaU|f°í żðÛY Iç¹) ÃO1| v¼m'æ1¯^à =·v'@ ,ð>¤{ |Gx}-¼CxâEÂ;¼FÎqB("zÞ%°q â |ÝnìQóì·KoMVÞµn}lN (ÝǨv 7¡WNÖ¶VïIÏv¸ßÊ×YØã£ßzðO×u¾úCÿb0 HðᲸܲÎöôwjSæò ÿz:Q°ãÆÜiøSmð ÊÙ¦â»Å{S*x&}D²¯Æe5ÓiÀêl«r[Ð $fg+î1¶Rö%9XÃfÊ^äè -Po+¡[ <Æ¢öظ -¦gru³k°ÙË;v%6mwÜ®¤ CÅOØ£âXÎ K&Cb kqâ ?gfÿ*l òZÀ c¦Õö-÷ãnÈÀ L÷rªD¥¤FX ª 4u¦ÑÕ ½X%%îÉNmIÛj;fÚ4ÊN}3nñ^ K"Òá-ÉÎÚIFG7zSZmÓµd@± U(fR%Ú §²ñ0è1¡P=±E/,-੽¦ÏÛb%%%h¦HpĦÌ4+@ tÊ£I;2Â.ð )pb³ì-p Ó Ü,JÄ«(u$§g)@ N Do s^¥PMDe² kÎ`ñ¢¹R@%v\Ùó@&¦ ×Ï´èÀ%«IµLÀp@ Lö}Ú²7æ)¤Øu I_\ϽÜ/s UßÌ9wÁ1Öú Êàå¨m©¬9eÁ ¯ 5LfÖ1 i¬¤Æb ZGbMðÜ LàÙ½9>xl ½ÙeÝÇ n, é,Fïæ¿5Þ×uV 1Bè8o ®U»±X Þ`b³9U²tW`P§@v` =lÙkMX,1`ħ M~«Úº7R)lØ ´E^\Ï¼Ü /Ó/D]´È¶ÍÀ5 "$ÎC$ ,pN«ÌZ\+ óJ1Hø *",N¢o«ÞMéµs/ %²©µJ°@ ÏbÇfëa?VD % Í(Û¨uÊS°Uvù§kîZà7y 5Xì3ì£lLð¹»À ìÖv¬ÊIR¢2è¯"Ï*,ã)ÌÊQ6*-@Ò@3bXILh90Ýù®ìƨÀ/ ¦làl)ð¹s >sK¤ÓdX MB«6.¨V ë¶` U0|WÀP«@j` ý\éjÏX+1XÀ ZG°µÂÌnÀ+° ÌJ°¹53 'pªÜ5À|RãÃ(¶ ]+-ÒRKÅü)Å0 aÅöf6¶Z6)B -íØZåB{À aÆveö¶Zv)OE´FÓZ°ò6×LÚoËt¶¹QÀ \äóoZm¹öÁ ZG°µÂÑojÊ6 wÍX¼Mõ;bG£xíÀ=ÝilS @ ZG°µÊ·v) [Û°¡²)*´J§CP» Ì©Y1ý(Éàe -ðü5 %wÑ&ôSãÈm4Ûd \)¦Å7 O(±K«àÚ¤¸ qO70O '±L [Û°£²1ÕCx¬ (%*%JPàÛAV8TmnöP{eYfÂ\»î 0 éfÖ$ fáH¶) Aïl)nfEÅb ¸"ddéøNåÂê2±H.& »¹w¸ ^°@T?Þó 3ÌZd2nlÅ NêgM§z5èÚ` Ø $Fgì)l¢ÊvÂM¥ÖÐÈs L6 0ÜH9$rÈE´À]Û-ͺqð {À¨¾¦ f*1K`%x\éó@%f ÖÍ´èÀ%£i´Í@ð@ L±á¿%ÖvÙImªj ËY÷{@ö` Ì NAk~Vß áOfçaGoìS¢õ¬ÎUlÞ ÈT&)Ï [W.Z¢( ¦×2 iÁ ` [Û°£²£)øæ·Jkr ¼îÞIoì¾HÀ¡))KgåâÀ[b " jÏ¡Ú£;*#@JøìòÎôC5óvú[öÍ;ϵÝ-ÛpK²ø 2ºCBåâ®ÔßY_^JUä±ñ,öÔKê¾=2ãÓ0°e+$Ê ä"YÒzäíPÞ JSò>t æQ.UËK8¬ L ejÍ«ãY HGaÚ¶ð"Yà2ñ\5o^p þ;bûfëa vûµk+us°µ²±MÂÊ0Qqk< ÓýÁ M Ù² jTZ ,n¾íeÙÅ}æ·ØZáIæ FJ3ee8Q@ TG®TÇÝ;póãØZåB{ -p6½» üG$ûi^Ò)¾#µy°¹Ï¡=À *`]½» ¼ETÏhûÑÉ."¥°»ÄOM6³m â-Ù» úÒØ¢ãÖX[zé¸ò¬ÆÅ ¨ vo¦@v v¨¾ëJïZÛV`¶7Ò \LdgbG~N·¯ M÷VÄ $ooµ^¶b5°í¥é6Þé"®|Þöl0ñM¤ïrZ/ÆÊØZçÍäÜ Ä2èY¬¸JÕ®7\ ÊÙ·â©OfÀ÷$û6ü «Î7 £®CÝ®_]Þ¨ @í7ó;e1°EÙ7+6ÉJ°Ìò2XÈ.q÷½6S³#,ÀÉÍÞ& 8úKݶ³²ê;D´Ëa0Éx^Ð'IB" :RX Ì~Ê~n~%ÁÓ^yuæõboúi)¾7eñ{FÉsìµÿf¸ %æÇ ì'ò¼ IÍÙRÐ %ÎSÂ)¾6þ·KíWCRhÍÇÉqò®m 6ls +@wL#Ú}0.ü¢$¿)ë6Ë.sti Jíþåþ åáÊ ÈìÙh9µ "TÊ© É÷ÐS -J!( AeÕÙ×X[ñ;Wõ´'IPG¶T[ ãÙjìe¾:¸ qüËÌ\²ÅÍ`¸ d .Aµà ! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~ Ù x l::«Ä UUV U :::::::::: VVV:««ää«r ä «:Uä « ä«rä«Ç««r á:U:: :: ::ä ä ä U::::U : ä V VV $ b1§ì p1 @ ÿ ( label A ?B RLÍKÉÈ 3 JÖ/áksYªÒNÝÔ4 Ƽ¦3»Ã iòl['÷ýpj >á D,i§ô@?ñ TÄÆM¬À àÌvÿ²3l¬Ø LÿÿàÌvÿ²3l¬Ø «ZÿÿàÌvÿ³Â(|¥8 fZ5ÿÿ«Zÿÿ«Zÿ²ó<«, LÿÿàÌvÿ 0 KU¥Ç¸KM-POx®k:3óÊÕâ^»Sëð .ÆÜ§Ï YÊe ¯ ñ,¸ÕÉi¥ª zeÉ~[O/úñ\m¯BL¸yð|¸\!ʵ ³ü8TKÅy^CTü» +µø@ ±iÁº «ZÿÿàÌvÿ Fuà¤úI`8[Y }uäYgÀàm¤|êj@K Z¤¦A| ÿÿÿM ÿÿÿ3WGámtSÍFÛ±d 8](ù·ÒôrÑÑ,½Rk®~ û2ºußíØÏiiÚ}>ǧùøgìÚêÒYJãJ¹çZðìºK@j[uà ÿÿÿÿ ÿÿÿM «Zÿ KUáÜ.:kìu i²]ttz0üª:+_I*£Q$ø$¼÷þ"àm´¯îÄVfÈ%egi¸ÂsàØú£Ý ÀÏOÒOóhٸͦqX'OË> ÿÿÿ& ÿÿÿM HÒ²áý8UÉÅÛÈ]!Þ¢´Ê09rVcº¤ ³ÒMµs¤Sm8Õ &F/ñ¯Ëf´ÊdQK'°2çÉFÖRø@ ÿÿÿ& ÿÿÿM TµÚqª<MÒ¦1¯Ëf´ÊdQK'°2çÉFÖR:© Lpþ*ÀdÖâíÁd.ÃïQCZe ¹+1ÝRYé&Ú¹ß ÿÿÿ& ÿÿÿM V*¸áÝ5!ÉqvëÉf e'¹!~µ°Y ãR@ì¼òlÔêªýVm5 Ñ,G+þ±ú¬®µ6¤RÅç²úI³¨ $ b1§ì p1 @ ÿ ( label A ? g0²Þ À 3 I_á`³Wª¾NÚÜ5 µÆ´T<2V)źCmÀÇi)¯Þ3Að 3 ! f C 0 HÜù-Ôµ?â?.àò¥¬ Ëwñ5JÉ̳r3~ñ_pzõ5È ¥/["gãwÆYÁ\¤¹3!Ô˦Ê}äX.[<kË|ý0 §×( |òyÂ=HÞ¨oýì?Æöïÿk¾ *µJWPjYNòe)Ê·ÿ*S}V"ªÙk¶ñ"ô1½éR[7V~}Î+©üóRùu²úå×Ú¥$±HÇÛB¾FÀ÷ÏÁ º@d¸ R;%ÄEY]DQ!ZÙÄ\ZV \ƶ7¥OdYñ¹ÆµÓ`ؽV]l¾±jKé/r\Ãm¢ß% âmóðFº d¸LÀe´8a\ê0*¯Z\õ´¾ ª § ¿B 9]¤ ÅÌÌæf2»à ÿ º@ ¿} Á½¼¤áC label A G C /redir.php?r=http://www.eclectasy.com/Fractal-Explorer/index.html @ @ i @ i @ø@ i @ i @ð@ i @ i @ä@ i @ , i @Ô@ i @ @ i @À@ i @ X i @¨@ i @ p i @@ i @ i @p@ i @ ° i @P@ i @ Ø i @(@ i @ i @ @ i @, i @Ô@ i @\ i @¤@ i @ i @p@ i @È i @8@ i @ i @ @ i @@ i @À@ i @ i @@ i @È i @8@ i @ i @ ð@ i @\ i @ ¤@ i @¬ i @ T@ i @ @ @ i @ø i @ @ i @ð i @ @ i @ä i @ @ i @Ø i @ (@ i @Ä i @ <@ i @° i @ P@ i @ i @ h@ i @| i @ @ i @\ i @ ¤@ i @8 i @ È@ i @ i @ ì@ i @ì i @@ i @À i @@@ i @ i @p@ i @\ i @¤@ i @( i @Ø@ i @ì i @@ i @° i @P@ i @p i @@ i @, i @Ô@ i @ è i @@ i @ i @d@ i @ P i @°@ ? i @ @ |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 289 bytes. |
GET http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5390 |
| Response Body - size: 5,390 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong></strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/hpp/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 280 bytes. |
GET http://testphp.vulnweb.com/hpp/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 203 |
| Response Body - size: 203 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/?pp=12 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 291 bytes. |
GET http://testphp.vulnweb.com/hpp/?pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 383 |
| Response Body - size: 383 bytes. |
<title>HTTP Parameter Pollution Example</title>
<a href="?pp=12">check</a><br/> <a href="params.php?p=valid&pp=12">link1</a><br/><a href="params.php?p=valid&pp=12">link2</a><br/><form action="params.php?p=valid&pp=12"><input type=submit name=aaaa/></form><br/> <hr> <a href='http://blog.mindedsecurity.com/2009/05/client-side-http-parameter-pollution.html'>Original article</a> |
| URL | http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 315 bytes. |
GET http://testphp.vulnweb.com/hpp/params.php?p=valid&pp=12 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/hpp/?pp=12 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 404 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7 |
| Response Body - size: 7 bytes. |
valid12
|
| URL | http://testphp.vulnweb.com/images/logo.gif |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 291 bytes. |
GET http://testphp.vulnweb.com/images/logo.gif HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: image/gif Content-Length: 6660 Last-Modified: Wed, 11 May 2011 10:27:46 GMT ETag: "4dca64a2-1a04" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 6,660 bytes. |
GIF89a2& ÷ ð|±´{²Q¥s¦ªQ¹®¨[³Ç׳«çGNQ±i¥e¥Rµ¼Úãz«¥R¨QªÄûçèQ°Èr¤¦ÔäéìlqºÌT¥R¬m¡¥h£´Q®Æuª¬\¬}°¬jªb¥T¥á
å,5tª²µ¦®´Þíñ¨ÌÚQ©{»ó´·÷ÇÉ ²X¥«ÌÕ ±±Q£¿Q¬Å÷Ö×ÜééR®R¼Z©R¨Ât¬¹·ÓÛ±©[£¼±¤[«Ã|¨]¦]¨°~¬Q¦ÁR¢¾±±Q¨Â ²©d°t³Ééóõa¨n¡©Q¢¾ôùú]¥R²R®Çó¢¥R¦Àe©yª©R®Èu»ÐàìëU©R°È²µ ±µUR´Q ½a¬ã$R ¼Z¬R¸R°³¯R«Äy«®R¤Àa¨z®ÃÙÚ|ÁÓ\¢µY§g³É²ÍÓ]§y©W± ´ªY©T±½¸R¶W¥§ÐÞU´i ©f©[¸Q¤Àn¥®V ¹RªÃx¦¥n¤©m¢¬R¡¸Q£aª|ª¨TU¤U¡½S¹U¦ÁR«Æ|ª¬T©ÂQ«ÆÔéïâ R¡Ài ®V©¨ÕáZ£f®£ÅÃÁÓQ¦Â\§ÁÉãëQ ¾R¬Âu¯ÀT®R¦Âo¦ØæéQªÂt©¦]¬Rªg©Á±¾©ÇÓa®V«¿R¨ÀÉÝæR¢¼R ¾S«Äg ®æñï ³±¶®¶«[³ÿÿÿQ¨¿TÆR¤ÂQ¡½U²Tµ[¤T¤¾U¢µ¾ßèQ¯ÇRÅQ¯ÃR§ÄQ¤ÂU¼e¬S·´²R³3MUþÿþ???¿¿¿þþýïïï///___OOO ÏÏÏQ±Éßß߯¯¯Q²Êoooæ<C_¤ë]c´´R±É\±Çg¥j±¿X±Q¼SºüîïT£ÀR¶T·Y¤í}²ÎÊs§³ÄÑw§«Q¥¼W¬ûàá!ù , 2& ÿ « H° Á*\È°¡Ã#JH±¢ÅÛȱ£Ç C I²¤É(SªT©Ý¸qæb{ùÒKfÉ¡ÉÐY¯ £."Üã Ö8ØÙ¯Í\¹<,£À¦×2e~ ˵, eZ1cVãPà«13frèc, 2$Xl`¡á H¸ATQ$_`$P$I +3kÞ̹³çÎÚPKól.Ið:àUH6X AJH {18@°à£$4l Ò&ء̶Rð2´sÒfÍ¢E»¶Æ W®B (wÇäÿèª "ÒàØÐ DÒ$Ø9¦* )ÀÀ0` æÏ (àvÚV^±ÃÎ8\-SE.WÈ!Gx¼2GÜÁ#ö E:N%YÄM "¸±Ç$3%ÌT± sÏ%HVtÒ¥åÁZlaÉØ]Ñ D"AL0 l°Àë ÆBR¥ÃÏ ¥0 Â)ædrt ã(c3ÌX2I*HHF"P|Hî| $ØA$¼Hx @ ¥ä"Ìe¥©à¤¦ã¥ z #Ö ²J(±Ã h@¹Á TP!Æilÿ°ARvÂn@¨±pÐ`)ì°Ä²8z¡Å2 C)Lr4xèÀ÷F !ÀÀ' A~èè2H$f\KËFçżìD7#³ó&Ë Zjµcuk¬Á¨J qv¥ Èã«T,ë¬d @B( á(l±$<R9Þ`C`hUh5/^0«)kä²!Æ Å<Á °@ <ÑÀaà+d ;°Ütùæi5ÈoYó2+s¿Ô|§@^q0ÂQä WhôA 1Tà°Þ$@¢JyðÇ Ìÿ _VcòàwDNo3 ËÍhQE1=³u6 <ò AÅ Ä0E$a!`1?b0$ 0r`3w©Ë.sÚUc̶ì5¿7Ñ ðjpvE!^h0ì른 TÃ0b j@Ð@#kf ê(`¾:ø¸0Oáì$â³x5hª -ýo§A"Á¼ xÅbð"!PpC@° i¨WØÁ%.;°)g9£iÐãHPÂÂx¿,¨©ñ¨GÃ+ ÎV¤»¨m C@° Høá>Pà @ ´yÿ¾Ì &(¸ÄL¨ãí 6§2x çXYrQJÐ ,á¿z$ìô Â0D,E ²àôàÀ90q«pâ×ïîå5X'a0jH IîqcDaÀç)ê;cÈËÚF 4tA7°Æ*FÀ4À HÁ) ¨"E< >2ÁÄZÖRÿ"ɦX*)4Fäprj 3¤ Hà °*Bð~Ä \¨\ á ¡²Ä cÉ~õËqÔ©&¡$@ô9|Ü× yBë xe ÕÍæÿB½8/nÅÀ*¬q?`áCPEð0øÀ @,K[Z°.ÅK_I£¸$Öã §(µÎ$¤E*ÿI#b, #Fð/ ÖzŶY ¡ G( ×?ß òqXÉ %ná W|à Xà ÍÙ/cÞ3`J(£%KEbôSÏkÕsÂÇC?<Ö0,Á !¨H&ÄÚUب°:*,müàO8$"hÏ{îÀÄwr³']C @§D E: «¤1 %X¥< U«jHü аHÀÓ°Ø=§ÕKÿv5/|¬6ð õD qJ ¡<@AZ WÐõ®Ð-A^õ:&¾É¯ø1h K âªÁÔA,FQ $E À Ì`µ@ìÀê#³Ç-ñÙ×õqÁ[K."90 @ $p±ÐÂ6í¨=QO â`mð&QåõA aè üáhà·uÃB -áùyCs?RÑèBW£!)Ç7àwr ÙÈÆGÈqnð8 òûqÜ #ÝÈF7QkÀï>I88ndCq²7ç )ÙÌÀr6ÄárùÿÉ&ñ«1ô\ôñSKæ køY 2ÀAnÀ @¢( Ð ¤àgkHá[ D¹L`b k©´® Ü9 ^O8¡ÒRèÄàiëxW {P Ò ÂÈà'´` ´-V$ K((Â:¾°Üw 6nÖ÷1Ã~QFGºñío?9Tüº+Ð+_# åF\8<² .lË}¸{#¼¬ ý88D`Át!~,«@Ú2*Mq8ÔÁÏØ*^°AoHA>(Mq?c¯ÿ;a ü µ4ÃØùu° ´!T÷¬ÁÄKnNtÂÏRÁ´3ÔèÎ a@ðçÖ Ô ôbZB\wÐ2ÛÐnGÖ]/gË;f7G^2¹çN·GÖÝnøy: ë8,ã=íÜ8³·Ë<e}W ßY7â±îo¤Dd?È 3#ÈH (®ðs?_@2è¥wáç%¬CÀ `0 Ä¢ÒNøC(þð )`ÂÃsðÊÑòäâÎ Ò±°j³xÃë¼5HásePºÏÖø¨XH £??MØdSOðÁâ¯vBÿ êÀ ®ãzÓR$Êu¨ã®eÀÀ þñ+Ôø¢áÀÝäosdà@f÷cU´n xâÆûæ vp¶nó6vSx?&w·xÀvóÆKà0GF@hp r`mpA@r ³¿ÀfTQ `ª ðjÖð 90¥@$A {(µ{q@9; x ~&9|tPi ³t }Ö Á`IC$Eçg*0r ¨ +> ü0P0 pBà@ÐV0àP`mÀ0e`W .ðu op÷å ?Pÿ8¨nÈt§ãï³à ¸xÖu T?ù÷ ðz@f@ ~¦ V à Pi` ª0~p y´G³Î WµH0¦à Nh {àS|t¡¢2×sȤBmp v0A¢ ÝaH i° #fÓÃ$P F0P«0 !Ð )нÐJìw. ñê`èÀðv vLÖ¨v8ØKYw¸·2ØP&Éek7ÿÖÈ,A'@ ¶X Ä=ÿàgMγ ¶àgwܳÁÁv ~ ·@à }tJð]÷6 mP ×à ÙÁ°st0 rc0 e m°C$Gt' `nO0~Àjàuîp+Pu-@m p~ø~Uµd ø§ ám a i !Yño)É ùä8Y´Ú `Ðg ¸ àgxÁ6ºµ²àg¬!#PG1³°À _ $ÈW,GIJp9pTÄ@$Ã`6ÎÖOÌØÿ g \Õ ^5ßXX d@ ÓP `¨ 2ÈüÀÀ E ( -0Ó`~xµWiK hQPt!QÇyÀp ( 1 x ":¢$z µý'o¡ ) Ðn0` Ô` ¨PVÖ[¯þðÖÀ^À vp]°8j h d6}D[ÐÉ{¡Â Á@p ÐSÞÔm@ôàÎ0C@~¶wayëßY%."I QûàyÀ Ià(°Ú >àueK. pQ6`¨ cÿI¡#á ±o :$ÛPn§qÊ8°8 Lð ~ ñà !æ3ÖðI n`C?i §Ìɤ;*0» Ý( Ï H¨@Ï q£A0Ú ²J à¬?èBt+1Õ DéÜÒ BP§`®C#wÈ § EàjK:¨µT¨iK Þe qV4J° ©ù¡Ø©àx ± ¥©(zëÖ,ÁF $@zp²B1°~ ò n@¤g ¦'îÐ R¤"k ¥ÿÀ ðÜØ´µ{0Pù HàgÀ ³9xt@*Cr$TÀ¿P =¥6Ì®q3$VS 'P§ZAD¾ <píGõZKPt¨ ûZKº ©¹Ûf ×wmª°p¶oºFÖ¤y¢'m è°¨ø C OÀ,P»hi@spÖ \KP IðO :ð¹ÖиÀ 4¡°;pÉ$Uh NP6Ù~æ{ðs '@Æ ÀÃ; ê3û£sPxð<}P l®ªrP ÿ DÀ 10ek 7 °¨gÕã¼ÐÌõ¶#¯LØfK ö»D Êù I¶ d\¾$"º [ äÀe¼©ª¤ §¸ Þ*ù¸[»o|pI` î K0î1" £NÀÑà£~æP X @¯ ªöÐ; ¡ä´}Ê@©p[èg= ò~@£*®£* ßègBÐ p à }H· ¯Â 1Ð @J\p n û¨ FÐ °u'A·¶4]ýû¿qÿËDz\Æ - <Æ|{xûÂ8± ©zeÙve7pëÁ ìK ¸#¡ 'ðý 0[ Pà"@r%ç²j·ò£ið {0\Ès9k6¡q»uR0 ̳ :pFÀ"ðþ ºLq* «nS0 þpÍú<Ü«4 ð$à# xÜ}*î+¤ ûHÈ&¿üÊêðu&0¡üÛ Áv¦h¡"ioßæ {oëÉ iÁo×0§xûfpTöÈ (ÚpIPulÐ Ç`F ã° ²êéP1°êÿá¬hðB\rÊ@)Ȥ: ÛlrM h°D #Àp ð <ÀÒÃ;Ã7)2,"m<V²¢Î1U71p%ûY'¶Z'S0C0½è^gKe`#ÁÏL$v£Ø Þp ß íå "ºdCß ¢ç °Aá××°fì£ -Ó%@àEEÀzð3- ½°(``$0 ¹ê¬j¬½° ðÚ¡0 Qp zTG >÷ÚM Ìg _ ÑÀ+°Ü@:À °oÀ*bÕ{P_²BÓ1ÿD0Op%X½`00 B¤Ã2F¿#Ax{ökÜF]øýx!] m¨7² !À 0\n (0 C3 ®0¬ø Xý<m£½Z{á¨Ñ²HOÛ¶ ¸Å:ÐÎp¼ ðC0 Ø 1:d ü KPÐí%DE*%Ó#SX`ü £ÍI%_ lP ~¸.eP Ð%1`e`ê ×ù=æG àB $RX'¨7ÀpM~àYwÐ 1pà4; ½Ù«½ Fð öàÒÿDB| N$] 9 ñà63T+F0CÀ°BD@ 0°ÃÛݼå ,@7vÁî@ °\<Ðà0C0pÚ l0åd^ìÅ¢ ®@÷w S J®¾û±äBéÀ U'C ¨]_iP b` Þ<Ô`è,`Ðd c@»þè\e$ÄÅ;%~j BP§Þ³¢ Ó ÞÕ§$n0~0÷ ±wÀ^B$à @"ßÆ~òyvp$ <ÿ0 0 ¼ ¾¼ °CÂ8êÎ a MÏó<b° @ d@c@ ÞéRÿ ¾½Ôà { O0Ç >à ®Úë< l ÝêSPpÚ|î ¶7èyp"~ (Ó3ø Äò_ *?=:@à ðõl@:°Á Fð`c+£*.7¥8° ®V{0èq xà@O õS à1éhà0ÏÑ}`×# +zú!À0çîðt# 0]0á²PðKð`×ÿS4àñ_I1bøæ ÚP´²ò@ð^&L¾b@ ^7¨oàûËO #<EH³`1ý) Ô Å *$åSj ±(Qd$Öq *¨pPA¸!$-fIÃ,StD §Ñi½|i@b@@0òtB#)ÂC(Z´H`Átnb ÀbÃ0Õª#[ÖìY´iÕ®eÛÖí[¸qåΫM 6èâF'HQ$@$A1Èó ' éºz5¸!QÐ5qSÚ4139r8x5Ëå4a¨Ôôá¯*½qD @äîÏÉ 2òs@¯ú !(ÀðaÀ üðé5Í ±tÕ¯gßÞý{÷Ú80èÀW®Î$úÐèÌWÈ8ü\æ"Ð ]`C?<îð>W6q¥¾A2 ä;ôÐCûtéà@ A/Rø BH¡ ÐÂY6!@ ØØä? {ð8áÞ $0/x8¡H yM@8¾AÄÒrK.»ôòK0ÃsL2Ë4óL4ÓTsM6ÛtóÍ/ ; |
| URL | http://testphp.vulnweb.com/images/remark.gif |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 307 bytes. |
GET http://testphp.vulnweb.com/images/remark.gif HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/guestbook.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 340 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/gif Content-Length: 79 Last-Modified: Wed, 11 May 2011 10:27:46 GMT ETag: "4dca64a2-4f" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 79 bytes. |
GIF89a îîî !ù , &yÁÝ
dJVìLÒimÜèQ¢e4BlêÑ*ÇíÎQ ; |
| URL | http://testphp.vulnweb.com/index.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/index.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4958 |
| Response Body - size: 4,958 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>Home of Acunetix Art</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id="pageName">welcome to our page</h2> <div class="story"> <h3>Test site for Acunetix WVS.</h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | <a href="/Mod_Rewrite_Shop/">Shop</a> | <a href="/hpp/">HTTP Parameter Pollution</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=1 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7994 |
| Response Body - size: 7,994 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>r4w8173</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=2 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5193 |
| Response Body - size: 5,193 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Blad3</h2><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?artist=3 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 322 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?artist=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/artists.php?artist=3 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 7880 |
| Response Body - size: 7,880 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Posters</h2><div class='story'><a href='product.php?pic=1'><h3>The shore</h3></a><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=1','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=2'><h3>Mistery</h3></a><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a>Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=2','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=3'><h3>The universe</h3></a><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=3','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=4'><h3>Walking</h3></a><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=4','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=5'><h3>Mean</h3></a><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=5','comment','width=500,height=400')">comment on this picture</a></p></div><div class='story'><a href='product.php?pic=7'><h3>Trees</h3></a><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a>bla bla bla</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p><a href='#' onClick="window.open('./comment.php?pid=7','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5311 |
| Response Body - size: 5,311 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Paintings</h2><div class='story'><a href='product.php?pic=6'><h3>Thing</h3></a><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='left' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p><a href='#' onClick="window.open('./comment.php?pid=6','comment','width=500,height=400')">comment on this picture</a></p></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=3 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/listproducts.php?cat=4 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/listproducts.php?cat=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/categories.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4699 |
| Response Body - size: 4,699 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>pictures</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/login.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/login.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5523 |
| Response Body - size: 5,523 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>login page</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h3>If you are already registered please enter your login information below:</h3><br> <form name="loginform" method="post" action="userinfo.php"> <table cellpadding="4" cellspacing="1"> <tr><td>Username : </td><td><input name="uname" type="text" size="20" style="width:120px;"></td></tr> <tr><td>Password : </td><td><input name="pass" type="password" size="20" style="width:120px;"></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="login" style="width:75px;"></td></tr> </table> </form> </div> <div class="story"> <h3> You can also <a href="signup.php">signup here</a>.<br> Signup disabled. Please use the username <font color='red'>test</font> and the password <font color='red'>test</font>. </h3> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 293 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 975 |
| Response Body - size: 975 bytes. |
<html>
<div id="content"> <div class='product'><table><tr><td width='180px'><img src='images/1.jpg'></td><td width='400px'><a href='Details/network-attached-storage-dlink/1/'>Network Storage D-Link DNS-313 enclosure 1 x SATA</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/network-attached-storage-dlink/1/'>Price<br>359 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/2.jpg'></td><td width='400px'><a href='Details/web-camera-a4tech/2/'>Web Camera A4Tech PK-335E</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/web-camera-a4tech/2/'>Price<br>10 €</a></td></table></tr></div><div class='product'><table><tr><td width='180px'><img src='images/3.jpg'></td><td width='400px'><a href='Details/color-printer/3/'>Laser Color Printer HP LaserJet M551dn, A4</a></td><td width='50px' bgcolor='#F8F8F8'><a href='Details/color-printer/3/'>Price<br>812 €</a></td></table></tr></div></div> </html> |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 365 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for buying <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for buying <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 348 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/BuyProduct-3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for buying <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 335 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 313 |
| Response Body - size: 313 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/3.jpg'><b>Laser Color Printer HP LaserJet M551dn, A4</b><br><br>Laser Color Printer HP LaserJet M551dn, A4<br><a href='/Mod_Rewrite_Shop/BuyProduct-3/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-3.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 352 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 319 |
| Response Body - size: 319 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/1.jpg'><b>Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br>NET STORAGE ENCLOSURE SATA DNS-313 D-LINK<br><a href='/Mod_Rewrite_Shop/BuyProduct-1/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-1.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 339 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 279 |
| Response Body - size: 279 bytes. |
<div><img src='/Mod_Rewrite_Shop/images/2.jpg'><b>Web Camera A4Tech PK-335E</b><br><br>Web Camera A4Tech PK-335E<br><a href='/Mod_Rewrite_Shop/BuyProduct-2/'>Buy</a> <a href='/Mod_Rewrite_Shop/RateProduct-2.html'>Rate</a></div><hr><a href='/Mod_Rewrite_Shop/'>Back</a>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/1.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 323 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/1.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg Content-Length: 3551 Last-Modified: Wed, 15 Feb 2012 08:33:19 GMT ETag: "4f3b6dcf-ddf" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 3,551 bytes. |
ÿØÿà JFIF ÿþ ;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80
ÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÀ " ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ? ú¦( ( ( *î§eb »º,vgüºÐÊ+Ö~&ø{LÜ ÁÇaÆ>Jâµ? ²§X£¨ÿ Áür? {màüqÔ~óI³aì¼}Oó«±|teAV?ì]úl4íÔWÃñÏO?ë´{ ìÌÇä+NÏã.rv;TÏC¶4`>§wJ ôú+âíÄ××Ú'ý6P1ù¶|!ã ÅöóMáûôºXX,µ=2Ï=( ¢( ¢( ¢( ª×÷Öu¹þæhGåp£?SVkÁ¿h Ûû_XËgyi·;eäã±?(æ;}[âï l%hãºíÇüñÏÔâ¹-cãxU?ÙÖ$ g%YÏô μ |a¨ û>àwÃ)þ´ÿ øI óq¡ÛIî¨*¬#Xø©â-H²$'AÆG°®NïYÔoù÷³H; pSß\> ÒOúýÆØÈþTWðÔ¼Kms ü Å"ýñÀ8oÇ¥8!_¼pAÚÞÇ·áZyðĤ¹":p¼gê)VÃE8ò5R¸@eè=8Ç ÔX Á=ÃY¡ Tú;V:+ªù·sÇn=}±øÖ¼Ft¶Zf¤'p1 Cµâب´ý Q×e2j·ÎP øfÏ8ÀéÚÍ»kÃÚoËPt óíúæ« cÄ:¸Ù¦[-¿@Ê2@úà+oNÐt5AHDÒâÒ¯Mv1@)åbð¾ù<íRåîfîY~¦½ö{µÛÄ:Àìã¿ÎµæòL[8àW¬~ÏPî¹×'=U!@~¥ÉþB° ÓET(¢ (¢ +Å~1Jþ Î eW¶F ¼;ý+Ú«Åþ9¦5hûÖ~Lÿ ã@ !s¦øvY I¥"·û$äjoiºe÷Å}"ÁmUtû Q,) ó{¼kGáÿ ÅÜÐÛÝGþ=VÐo¼ø{á¥Ç>y.ÊmrÍÁ=O^õÀü`ð.áÿ ú¹¤&§Ì j·{pw03Ðÿ j§ÅWPñ^¤Íqæ¬ N$#ÉPp»G@1÷$Wñ£âÙkPW縵¾KQ;òeE$÷ëûQ(J)7ÔOCË.4àPÛßÃ*ã,J?ªwðA$ÖQýÓçWâcå§'¥VÔ¾Ç(Éû¦y. <kÖ|9%Ä07Ú¦;¤l¸]¡A\ãõë^M`37å^µ`6©ôò@*PÍc;¿SMÏ µ;uP^ßû=Eÿ m^oï\¬÷Êgÿ f¯ -é^ùû>ø¤/Û¹¿oý &§ÑE# (¢ (¢ ñï«þ§X ~Gÿ ¯^Ã^EñÔfm0÷ò¥þk@ 1ùlü.ø¥¢ óæ/þÍX³ýóUwÍi¨YßYÌÐ]Ã*lNùò85lGÖ~,ð â{µ¹Ô#.@ÛæÐ0 ùW ûBiVZ'ÀÛÛ 2Ý-íb¨'êM.½¯ÝêZ6}#YÇqu¦[Ï*±ÚK3|¾zg¯µp?´.olt_Û*¢MiÝÌîrXíÈ AúÆ/} ¶<¾aýÑüª¶¥ÿ sºjÚ¨B£ªZÿ CýÓVÉ9-(n¸Qê½^Øà8 Þ?á^W¢ ÝÇþð¯O¸cêÍüÍJyM?5]Zº¨D¹¯ ?gßùo?ëýÿ ô\uóØjúöz|øFý}/Øÿ ä8é0=J(©QE QE Wüs?é~z$?¨ÿ õÊñßr¦Û'¥« ÍøPM÷gß!qÎ?ÿ Ç hM÷[ðuêÞ4°ÓY¶¼øXØäÇrNLâîu#+Âãb¾4·^G½y×ÆV'âV·º=¶?ïѯrñâçO·Ò&µ[m>Æ;eyNýªN À>£ZòßÚ#·Ú5Öâ¸Ëmöhl® ìuL}Ï>£ÞÕlÛ8#Þ¨jgsºjþàW>¢³õn,fÿ tÐÆs:ü~Eþø¯H·|¦}Ïó¯6ÐÏú\gý±^dÙ}Oó¤h+b¤Ö«Á©w4ÄO÷ÙÎmÚ>±÷'GüÔý¼¥Å{ÇìÝk:izÍÔ±²Ã<±,lG ´6qÿ } O`=(©QE QE Wür wg÷,ÐãÒW¸WÎ / -¹FÌt<ô4 <¾S5«ðÀÿ ÅÞÐWÜü-`È»î k|+Iñ£BÚr0ßú.J¶#½ý |KâmĶÿ Ùwv¶Â{uý\Í0Æç±è1W?h+©®þXOw ·¹KW 1±ÊF>¹®Å:åú|aÓtu¸ ÙN[£FO1ÆyRAÀ ®{öÔ!Õ~Áql$I¨Ä£ÌBã¡úT ðÃÂYÚÎ>Á7û¦´[k7[8Óæãµ[ÌèÇ)ì»Ë3=êkÒÎ.ÿ hWia'Ë(ô¿J®®^Ë֫²O*E 3Èçjª}{GÃïI§ùz¿ËyÃGlyX½ÛÕ½º ¡þø}&¡åêâ4V Üú/êkè? BY<Q"Ç`V,qÉ®B]¶îÿ ÐT¶3F) RÑ@Q@|ûûAxP×¼C£¢,2ÍäªM¾ÆÈèU¾ü«è*åüAn$½vÚ3Ïá@ ]øgÅÚn|ý*õwUYÇê Pðίwá_ÚëS[¹º¶'lsÂȸ*ÊAÿ ¾«ë£n½ÕÐÔQéPê"Úx¢7üô@GCþà×ÿ ´}wÄöZæ£e}knźÊé6º#ÚC¦FI áEOñwââoE§éÞ%Â^Çpc% (Ý<ò~µë¿Âÿ ÝÊc¸Ò´ã+rcËcùb¹ càvxÖúÇ' ¤¹\þ9¦ÎÇZ·R¦Á÷B?¥A©ÝÇq§Jbuaßi¯dÔ>JAþÏ×UÇe¸ú\®§ð[Ä°0ÛØ]XdØOç.éËpë]Ï tÛÍj÷ìºt/<ÒÈv ½~ô7¯\ë i>< ¸nP<µ »ºú{Á>±ð¶ö{4 rã÷÷|Ò Aè¾Ô 3üà[O Ä·l¹ÕX|Óc+²wEKun8é Ç[ºJíµÿ Ì:×° ôfJZ (¤¢( ±õhó9>ª+b¨j ¹Áÿ f0u&5XØÿ #VTû8ñ{ÿ = >æ ÚÂ3 ,c> ÓuôÝfþëSßË4s :Z51æY¡Æ2ÀÐ<ÖÁºj7¶ §µ¼ªdåM c¤ ò*ÌQ`=jÒCÏJ"ùÏÖuj8éÑÇVQ(¨~Ôb,{Ô*f! ühôQE QE QE ^årGÒ¬Tr â(ùtèÓd±Ò¬ì¤Ù@ ì¤ËÔqQÞÑîNjb¹ÇÒéçÒ)ùTwˤ1Ð?ýjø£Ùó·Ö#D©Ñ)È* "I@¥ ¥¢ J)h ( ÑE qE QÅPGQ@ ÅD@Üh¢$P)ÔQ@ EPEPEPÿÙ |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/2.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 323 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/2.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg Content-Length: 2739 Last-Modified: Wed, 15 Feb 2012 08:27:20 GMT ETag: "4f3b6c68-ab3" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 2,739 bytes. |
ÿØÿà JFIF ÿþ ;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80
ÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÀ " ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ? ú¦( ( ( ( ( ( ( ( ( ( ( ( ( +Xñ.¤·wKæùf3~C§ã@4Wj tË{ÞÎiNæ çO²ø']òéMÇï¹úãmSækA&²=*äôÿ éD,Í-³ ùè¹ ®Þx®"Y`$º2A© h¢ (¢ (¢ (¢ (¢ (¢ (¢¹^ ÿ oÃSÞ£ dàó ?(â7ÁÛLÒßýì òìzòi§v,ò9$òI5uâé%¼ycvv,ÛòKgÔè4w²ñF-Ö2ÌÖä}²Ñ\3Ƨø£¶ â¡- ïí ¼J $³÷'ÜÕÈu@ØÍt¶^îX^ Ã( ¬;ìmþÚ¬ ±âXh6þ6ÇÍ[ºnô Îc·?4då\{»â?Ãg 4mæR_¾|avÜâÜú§ÃÚž·¦¥Ý±Æxt'nâ´ëÇ> êlum÷ñÕý7W±Õ"°QEÄQE QE QE QE ã´j\ÜiúE´4ì°ìËü@ÑVÒRH#ó.-[ÌTîë2|*Lksâ/ØÞÙéHÂ3o`Î?àn½?|y ÔrGHäNÌ6çô ö_>qi=öÁÒUÚêà ±® ÂÞ´´½ûb´þ[ ªÒ Dzà ëR=Hñé·Ãndkt&|eAãøWmcãëë}ÑûÌk ä2 ÄäÖ¥¦öx 9Gô ãéF A¯øÞúûQû B IäòGúô¬]{JÜ\ÄG;!âd»ãÛ<~µsTÐÞAso .±õ%7CVÔ)Ïå§d'§µ;»ð)Äúj÷Dÿ ߶¯~¯8øE£Ä×£óY)`=rxü+ÑêáEP ¢( ¢( ¢( ¢( ¢(ñ/4Ýj) c[kÆùÈ óî: ç^9â?kÞ »_Û=Åô¸nP=ý?ú*3@Ó>h:¤;G)'ûMþÙÁÁ פü_¸ÒôkKs.eq%âÈpP+Dà §§#'Ö¼ïÀ¶ðE¬YiúÞ ¡%õÊ,2¼åDqw ä8# 4¸ÕÔ̬#vfà 3] ü¨jÒ$ú=rC HãÐßS^©§húnÿ 6ð Xã þ}kB¹lía³¶ÞÚ5Ô*ªö5PHQE QE QE QE QE QEcxÄv:·xäÈÃä~ó÷ ã|gã{muµ [þë?÷½ý¿q:¿Ä ^ýml <Ëþñþ®PËeNI'$W)Dµâ-z÷Z½µ)ÚTVΠ¨öÀ¤Ôu²CbÖ¸B_ÌVÃ'¦ç5!2!wûïè)ö2ÞÝÅd¸"SÚøm¯I¯øn9n}Ì-åHÄcwò?¥uu àÏÅá Îù>üÏýç=Ãé[´Ì (¢ JZ( ¢ (¢ (¢ Î×õXtm*{Ùù¼Ç ¯õ-Në[Õe¸ºrÎç$öÐ{W¤üaº~h3åÒêzËμÎâ '9wK®A qD°§éòÝ̪HGV' }#OÕ @g°Ib,´zkKÆ- 4r@ up qz¿"ü ¤g«\Å¿g¤\ »§aì=ëÒ~ è>j˯]'s°#ðfþxÝê½°Ý-Ä}XàWÖZ.¥ZX[ Co}ñßêzÕËÔV&·âm3H,ù gÈoÄvüq^Uãzíôª7îÜÿ Aø~t +â¿YhQ2ef¼ÇÂû±íüëá¿5 gZÔäÍ$&0á p ¸'ò¯Ó£«^¯dy[ 2I5ô|7ÿ öDä5ìä4Ät\tQôÉüI nÉ EQA!E%- RQ@ EPEP-ãß>½eÚvä Àpz®ò{k9£ÕÖéCm+ Å}Uo´ûKøö^[Å2×8ú Ô¸Ó±¡i±Án ðØè À ÿ Zá¾,h§UÚkdYZßpòËãü+½ÿ bÍ8¶öÙ}"¸`?\Õ+C1ùµò?ÚpOò¢Ã¹âº_<B÷ÖÖPÚªD*©ïæ½1nõDÓ oYóê¶å 'òë[ðø.ÍÏy~ÞÞhùUÈ|)¤FC5»JÞ²;7éQ`¹åz{¬ÛiÄÑ!^¾ürO½;Føc¨ê,º-!êwòÇè¿ãökh-Se´1Ä Ò¦¦+^ð¾áøñef# 3òçüÒ·h¢Q@Q@Q@Q@Q@Q@Q@Q@ KE RRÑ@Q@ KE RÑ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@ ÿÙ |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/3.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 323 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/images/3.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 344 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg Content-Length: 3560 Last-Modified: Wed, 15 Feb 2012 08:28:15 GMT ETag: "4f3b6c9f-de8" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 3,560 bytes. |
ÿØÿà JFIF ÿþ ;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 80
ÿÛ C % # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿÀ " ÿÄ ÿÄ µ } !1AQa"q2¡#B±ÁRÑð$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿÄ µ w !1AQaq"2B¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ? ú¦( ( ( ( ( ( ( ( ( ( )H±FÎç M `êÂÉ+Ço)U^ä ~µTj2ÏÄߪ> ÓM¦ Wd¸Ë<:f$ÿ :ÓÐÿ pPcRùøó4ñ¨·ü÷ó4Ñ ³3Tܼr*F´cèq@ Ôþ{IùpÔÏüö«É`?åìÃ5VKYÓø7Uæ4¿µ?é¬jùë%b³`àð} BÉ æ;F[¯½ tVQÿ -¤¨_¶K«ky/6MpÅ"V8.Øί ×;,`wýöETÁµ-sJHe³Ym\ÜâæMªT ~ldç¯J ïüé¿ç£~th$yÅ;g½4Ä g4 }¢_ùèÔ}¢_ùèÔÝ«ýáùѱ{0üèÔzQª©`ÇI8óâ¯Ö ö±Ï Å2ÆÖ¸¨|?«¯öú äÛïm<nÝfûáúg½ tTQE 2icgXâE,ÎÇ@êIì+ KäÔãI }ÖÌ7FGF£V?Æáޣ墷%N×C~¨ìçÖÚ(!\GQÀb6Õ<(õ¬íúÓ ÿ ·ë@ª?~U*ìÆöÿ oÖíÃÓõ Æö¬ÅÔvôþtñªî µ,!Æ$@ÃÜf¨Magfä>Ç"¦© q +ú^ ÆQÕ¾9Ë»)IL8öàÖGQã¨÷£ªÃ$q$\gð®Îæ´àÖaõ&º#? Í÷¦r c¿zï yǽ x?> x¯Qñ§{g¨iËoqs$±Á ÌHÈÛïV| ðÅztÍNòûO{{iÈ©;G|µìï{?7' >Õ Åé|¯(`#ÚÏøg é<ïÍx×ÅÍGPÒ¼m§ßilÉ2[+\pC·ô¯Jë÷([;¶îÆsøã?JòºÁ²Ö4ì(o29öoþ½ }áý@jÚ¨ .íão¦å ð®O7áÞßôê£òÈþP5ûCÌaðN7êëúý*#zÒþÑãþ(+cé¨ÀF¨Á ëJ%oZPho5½hó[Ö¢ÍA?ÙìææÄhÎv Î õ ¾szÑç7qÞÖnï'[;ËË3O) 6îà e#Øûë Kç7 ku¢&ÐÅÔ.`LØô<ÖuÖ¢ïª[Á#ï 0 ¹Ïýô?Z5|.«mu &u#dV²Å#$ |§¿¥ kùëKæ1ã5öë¯ú]ßÈ¿øº>Ýuÿ @«¯ûùÿ @J®L|/P ÐQ§µ1ÝG¸8éù R·'®r=ËÅÿ Å×ÏZßµÍGRuÔo-£.vC Ìþ´ô®æH¨ڪ0 W|p½K½zÊfS%¼$H Î 9ëç\Qñ&ºAXÔ?ôòÿ ãYáÙÜ»±f'$híÀ¯Ã/r~Ì2E?á ÇÃoתÿ 3E s_´xÿ }ô¿ÿ èU «?´hÿ uKØOêj¢ ?4¹¦æ x4 AS3K@ o'D'#JÙêÌÇ$óÐ Sis@ i(&4 ¹¨Aýÿ üÔÔKþ¿þ¥ M3InhI¯$ÿ Xÿ ïú´ùEþû}M 4Ó£&M }Áðcá¿¿ëÑ(¥øT1ðçÿõç ò¢9¿Ú,gá¼Òîú §å¡ûEÿ É4¸>0üz²Ñ¾Aô ³@5 ïzp4 úPi¥Í ?4f3@Í&i¹£4 ¤Ô@þÿ þO&¡÷ÿ ð@æi4 f¾QcÉú×ÕD×Êdõ &y¦±¦Í }Õð¸cá×ëÊ/ýwÃ! ÿ ¯ôE s?´Wü Ãé<?úcÆsý+göøW©a#þþ ðKOzÁk; víþ5pMØö )OVþû4ð;¿\ýó^F>(_Ï¥æßãN oçÒÓóoñ«ú¼ÅÌ]Í«É?áhÞcþ<í?ï¦ÿ oü-;Ïùòµÿ ¾a0æG®î¥Íyø©yÿ >6¿÷ÛSÅK³ÿ .ß÷Ù£ØO°s#ÕnÒY dáä=$U GàxªqÙß©µi_ s c?¥yÇü-+¬gì6ß÷Ù¤?î¿çÂÛþþ=ö°s#ÔÊM±r,ÛGÍíN÷ÿ ð^P~*\ùp¶ÿ ¿·<ã+ß_ÜGº¤åÍ`2HÀοåYûMÍs¿&MS2j?óíiÿ ÿ ÄS üûYÿ àCñ ]&¾VþúhI¨[ÚÜ?û%|Æ Á= 1Í4 hsHhï?à ü8?é ý QNøv1à/úÁÿ ¢ÅÌ~ÐÃ? õOúéþZñ¸¾è"5ÿ HÔ:ùhüM{'íÇÂXú< ú5kóóØUFN;®qð«4/ùïÿ ÿ |+пçâÿ þþ/ÿ ]¸zPõ^Ú}Ådq ðªô3ÿ /ÿ ÷ñøOøU: üüßÿ ßÅÿ âk¹ó)|Ê=¬û  : üüßÿ ßkÿ ÄÑÿ £Cÿ «ÿ ûíøî¼ÊQ% Ö}ÂÈáÂþ~¯ÿ ïµÿ âiÂþ~ï¿ï¥ÿ ï7ÑæQígÜ,þ>zÝßcýåÿ ì|=¡éþ ±û.îvcsêM\ßAzNRÝ ¬MæqU?´µ7±ØâEM»¸$uÎxô§ÅdÇg:ø}Dº}í ¹;bN:cTÛ-_+©Èo÷ÛùúSYÔ¢ÒôËÛ8P·=Ïaø+æx*sýãüÍ #¸SiëÖêóý<hïo xÃÃþ¡ðèµ¢àahþ ÿ ÑkE s ôû½Sák§ÀÓܳDV4êq*úWǨøõ"U>R@ õÿ Ç«êË¸Ä t5±Ú¿ |±ý«ãÑÿ 2ªþgÿ £û_ÇþeQúÿ ñUõ?ØbþâþT`ûùPË Û>< ó* Èÿ ñTÛ: ó)·äßã_T} î'åGØ!ÿ iùPÊßÛÞ: ó)¿ýòßãGü$ 8ïá)?ïÿ ú§û> ùæ÷È£û>ùæ÷È á"ñ¸ëá)ï¤ÿ Æ£¯gÿ ¾ ¾ªþÎþy§ýò(þÎþy§ýò(å_øI¼gß ÷ÃÑÿ G{øBçþý¿øWÕ_ÙÐÏ8ÿ ïGöt óÊ?ûäPÊðø¼uð ßýûð ø¯Å¸8ð}æëá_Uÿ gAÿ <£ÿ ¾E ÙÖÿ óÊ?ûäPÅ %ÿ ÏÄ,«{£ê n§+ vÎ SÇ'ëXIá_"Ú&¤Iÿ gõúWÝÒhöìrªÓ á×¿è ©à3ÿ =<3®îûRÿ Àgÿ ûû/AGö4^Â1< ÑaJI (Êz(X×dj£¢( QE QE QE QE QE QE QE QE QE QEÿÙ |
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 370 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-1.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/network-attached-storage-dlink/1/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 100 |
| Response Body - size: 100 bytes. |
<div>Thanks for rating <b> Network Storage D-Link DNS-313 enclosure 1 x SATA</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 357 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-2.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/web-camera-a4tech/2/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 76 |
| Response Body - size: 76 bytes. |
<div>Thanks for rating <b> Web Camera A4Tech PK-335E</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 353 bytes. |
GET http://testphp.vulnweb.com/Mod_Rewrite_Shop/RateProduct-3.html HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/Mod_Rewrite_Shop/Details/color-printer/3/ |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 405 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 93 |
| Response Body - size: 93 bytes. |
<div>Thanks for rating <b> Laser Color Printer HP LaserJet M551dn, A4</b><br><br></div>
|
| URL | http://testphp.vulnweb.com/product.php?pic=1 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=1 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6428 |
| Response Body - size: 6,428 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The shore</h2><div class='story'><p><a href='showimage.php?file=./pictures/1.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/1.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $500</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='500'><input type='hidden' name='addcart' value='1'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=2 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=2 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6368 |
| Response Body - size: 6,368 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mistery</h2><div class='story'><p><a href='showimage.php?file=./pictures/2.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/2.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $800</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='800'><input type='hidden' name='addcart' value='2'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=3 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=3 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6401 |
| Response Body - size: 6,401 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>The universe</h2><div class='story'><p><a href='showimage.php?file=./pictures/3.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/3.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet. Donec molestie. Sed aliquam sem ut arcu.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $986</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='986'><input type='hidden' name='addcart' value='3'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=4 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=4 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6453 |
| Response Body - size: 6,453 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Walking</h2><div class='story'><p><a href='showimage.php?file=./pictures/4.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/4.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $1000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='1000'><input type='hidden' name='addcart' value='4'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=5 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=5 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6382 |
| Response Body - size: 6,382 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Mean</h2><div class='story'><p><a href='showimage.php?file=./pictures/5.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/5.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit.</p><h3>Long description</h3><p><p> This picture is an 53 cm x 12 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $460</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='460'><input type='hidden' name='addcart' value='5'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=6 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=6 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6454 |
| Response Body - size: 6,454 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Thing</h2><div class='story'><p><a href='showimage.php?file=./pictures/6.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/6.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Donec molestie. Sed aliquam sem ut arcu. Phasellus sollicitudin. </p><h3>Long description</h3><p><p> This picture is an 99 cm x 200 cm masterpiece. </p> <p> This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information.This text is not meant to be read. This is being used as a place holder. Please feel free to change this by inserting your own information. </p></p><p>painted by: <a href='artists.php?artist=1'>r4w8173</a></p><p>the price of this item is: $10000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='10000'><input type='hidden' name='addcart' value='6'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/product.php?pic=7 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 316 bytes. |
GET http://testphp.vulnweb.com/product.php?pic=7 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5734 |
| Response Body - size: 5,734 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>picture details</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <script language="javascript1.2"> <!-- function popUpWindow(URLStr, left, top, width, height) { window.open(URLStr, 'popUpWin', 'toolbar=no,location=no,directories=no,status=no,menub ar=no,scrollbar=no,resizable=no,copyhistory=yes,width='+width+',height='+height+',left='+left+', top='+top+',screenX='+left+',screenY='+top+''); } --> </script> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Trees</h2><div class='story'><p><a href='showimage.php?file=./pictures/7.jpg' target='_blank'><img style='cursor:pointer' border='0' align='center' src='showimage.php?file=./pictures/7.jpg&size=160' width='160' height='100'></a><h3>Short description</h3><p>bla bla bla</p><h3>Long description</h3><p>bla bla bla long</p><p>painted by: <a href='artists.php?artist=2'>Blad3</a></p><p>the price of this item is: $15000</p></div><div class='story'><form name='f_addcart' method='POST' action='cart.php'><input type='hidden' name='price' value='15000'><input type='hidden' name='addcart' value='7'><input type='submit' value='add this picture to cart'></form></div></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/secured/style.css |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 313 bytes. |
GET http://testphp.vulnweb.com/secured/style.css HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/secured/newuser.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 343 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/css Content-Length: 5482 Last-Modified: Wed, 11 May 2011 10:27:44 GMT ETag: "4dca64a0-156a" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 5,482 bytes. |
body{
font-family: Arial,sans-serif; color: #333333; line-height: 1.166; margin: 0px; padding: 0px; } a:link, a:visited{ color: #006699; text-decoration: none; } a:hover { text-decoration: underline; } h1, h2, h3, h4, h5, h6 { font-family: Arial,sans-serif; margin: 0px; padding: 0px; } h1{ font-family: Verdana,Arial,sans-serif; font-size: 120%; color: #334d55; } h2{ font-size: 114%; color: #006699; } h3{ font-size: 100%; color: #334d55; } h4{ font-size: 100%; font-weight: normal; color: #333333; } h5{ font-size: 100%; color: #334d55; } ul{ list-style-type: square; } ul ul{ list-style-type: disc; } ul ul ul{ list-style-type: none; } label{ font: bold 100% Arial,sans-serif; color: #334d55; } /***********************************************/ /* Layout Divs */ /***********************************************/ #masthead{ margin: 0; padding: 10px 0px; border-bottom: 1px solid #cccccc; width: 100%; } #navBar{ margin: 0 79% 0 0; padding: 0px; background-color: #eeeeee; border-right: 1px solid #ccc; border-bottom: 1px solid #ccc; } #content{ float:right; width: 75%; margin: 0; padding: 0 3% 0 0; } /***********************************************/ /*Component Divs */ /***********************************************/ #siteName{ margin: 0px; padding: 0px 0px 10px 10px; } /*************** #pageName styles **************/ #pageName{ padding: 0px 0px 10px 10px; } /************* #globalNav styles **************/ #globalNav{ color: #cccccc; padding: 0px 0px 0px 10px; white-space: nowrap; } /* 'nowrap' prevents links from line-wrapping if there are too many to fit in one line this will force a horizontal scrollbar if there isn't enough room for all links remove rule or change value to 'normal' if you want the links to line-wrap */ #globalNav img{ display: block; } #globalNav a { font-size: 90%; padding: 0px 4px 0px 0px; } /************* #breadCrumb styles *************/ #breadCrumb{ font-size: 80%; padding: 5px 0px 5px 10px; } /************** .feature styles ***************/ .feature{ padding: 0px 0px 10px 10px; font-size: 80%; } .feature h3{ padding: 30px 0px 5px 0px; text-align: center; } .feature img{ float: left; padding: 0px 10px 0px 0px; margin: 0 5px 5px 0; } /* adjust margins to change separation between the feature image and text flowing around it */ /************** .story styles *****************/ .story{ clear: both; padding: 10px 0px 0px 10px; font-size: 80%; background-color:#FFFFFF; } .story p{ padding: 0px 0px 10px 0px; background-color:#FFFFFF; } /************* #siteInfo styles ***************/ #siteInfo{ clear: both; border: 1px solid #cccccc; font-size: 75%; color: #cccccc; padding: 10px 10px 10px 10px; margin-top: -1px; } /* negative top margin pulls siteinfo up so its top border overlaps (and thus lines up with) the bottom border of the navBar in cases where they "touch" */ #siteInfo img{ padding: 4px 4px 4px 0px; vertical-align: middle; } /************* #search styles ***************/ #search{ padding: 5px 0px 5px 10px; border-bottom: 1px solid #cccccc; font-size: 90%; } #search form{ margin: 0px; padding: 0px; } #search label{ display: block; margin: 0px; padding: 0px; } /*********** #navBar link styles ***********/ #navBar ul a:link, #navBar ul a:visited {display: block;} #navBar ul {list-style: none; margin: 0; padding: 0;} /* hack to fix IE/Win's broken rendering of block-level anchors in lists */ #navBar li {border-bottom: 1px solid #EEE;} /* fix for browsers that don't need the hack */ html>body #navBar li {border-bottom: none;} /*********** #sectionLinks styles ***********/ #sectionLinks{ position: relative; margin: 0px; padding: 0px; border-bottom: 1px solid #cccccc; font-size: 90%; } #sectionLinks h3{ padding: 10px 0px 2px 10px; } #sectionLinks a:link{ padding: 2px 0px 2px 10px; border-top: 1px solid #cccccc; width: 100%; voice-family: "\"}\""; voice-family:inherit; width: auto; } #sectionLinks a:visited{ border-top: 1px solid #cccccc; padding: 2px 0px 2px 10px; } #sectionLinks a:hover{ border-top: 1px solid #cccccc; background-color: #dddddd; padding: 2px 0px 2px 10px; } /*********** .relatedLinks styles ***********/ .relatedLinks{ margin: 0px; padding: 0px 0px 10px 10px; font-size: 90%; } .relatedLinks h3{ padding: 10px 0px 2px 0px; } /************** #advert styles **************/ #advert{ padding: 10px 0px 0px 10px; font-size: 80%; border-top: 1px solid #cccccc; } #advert img{ display: block; } /************** #headlines styles **************/ #headlines{ margin: 0px; padding: 10px 0px 20px 10px; font-size: 80%; } #headlines p{ padding: 5px 0px 5px 0px; } img { border: none; padding: 0px 10px 0px 0px; } input { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } textarea { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } table { background-color:#EEEEEE; } td { background-color:#FFFFFF; } |
| URL | http://testphp.vulnweb.com/showimage.php?file='%20+%20pict.item(0).firstChild.nodeValue%20+%20' |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 359 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file='%20+%20pict.item(0).firstChild.nodeValue%20+%20' HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/AJAX/index.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 392 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 261 |
| Response Body - size: 261 bytes. |
Warning: fopen(' pict.item(0).firstChild.nodeValue '): failed to open stream: No such file or directory in /hj/var/www/showimage.php on line 13
Warning: fpassthru() expects parameter 1 to be resource, boolean given in /hj/var/www/showimage.php on line 19 |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 12426 |
| Response Body - size: 12,426 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ù¬ÄìóÛÏ»)¡¢Øéʧç¢Úêôã,y3e®êÀ &ùcÑ[Kôá¶Z8Û! }cÕêóèÝ$óPLeí0¯ ô3]Gª¦¼ûåëÏqµÅU¼$ÅA1 LNù)öUvèÁ÷ôÜ*Umðwk¶«"$ Ëm6äg©> ô:ÛÄ`bj3ÝOIÄI,D LMNû553ëOW 1ñ¾c?¨KéÀÒ "ÓvÊßdyó-<Ò¡Ç2Õ ½M!²Ç]'Ùêìvj²b 4Æi{tøj(Ñ_¥\Ù_ÐÆxï 0çM¦Þ¥ØcÇ t1Saè6ù¦xµ5Ó¹ÝÕoô¨°Á˵ÝmÖÚ<É«- ÇVjrvký¸oò]lÅ]Ñn.ÑM7×ÚVu}ðqÚùæfÀÉ^A£>Úi¹MzK0äç_dïÏx4ñ7¨ÁíÌ¡ô¹öåcZj»²¸ì"fN«²V²½¬6Fâ¯-AFÜ~ÌÕ]¼GaÕrH"H*H9gMÌÒz|¶Å)8Öפw¹¹o:xÔ9}2_D_GËuºÍ±\ötXã#W»:ãæmbg*¾®3ólnWdÞ&Í *zäÑëtEÙ3Ù³?D§§¼\÷ϤéSo&¹¾ôÞmN?C×I\,ë(ë¹é:|NkÈ㿲'ÕÛ K]¤ßÎù 9P ° ¢`Ó¸I¶¢½FõE³Lê7Ýçubú§/µ¦rs´tÎ4GO ÍÚ(Ó͵î¹ù=fÛOÖçF½Z|ÚÈlë ùñÞ T4LHÔñÕo]ØߥVËèVf2{/=q ³&ÀÓ5}OYÓ_;ÅÜUÙ , &&*@Ð:î»»¯²Îë°²ê,4ßA¯V]~mYÖm/uSzÿ £i}yÓkçÐ ÄM hu XvI=óa6òÖ\1ÌtÓ»>~£qbÜa·ßíë?ÊéR÷J¾§<µé¯´óày´@ PD jlØ ®NC¬ëpbØÄ0ÑHyõ²ùúЬ>3Ú ¼±ãôë{sÕ! ÿÄ ( !"01@$#23ÿÚ £ÍÜÀ¦7b 0ÿ ·Í4¹Úºµ°°E2« (ê tW.Vê×Ó »½Ýª¶£óÿ ´lM_äºßÊD ±P8ïùR,ZU»Î[íÓGæ®Hmö¼E°£;ìÄö¸Z©[õJ[ªo¦ÁOXÿ ß%G@eo´Ú~ÚBF»^^ËÊØy^V¹0÷;áàq¸ö ë¹n6\§µgúÚdÕÇ[v ~ÇU©o^N¤Ù¡î¹°l¼3)¸¤[°«z0ZÇGto¿uf$ÒA±0<c¥_RÛXTºfBÐ"ÊjÄÿ ê6 !ô©} < ]RÃJNkmgÑULëÇ_{Ø%{J.ñÓÒ ÕÄZË|ÓVî?XPé]-[ìzXQ?@_Æ¢ç,ÙßÓ k½Ãt¿k(VZîÃ0ù [}u¡bÜr°PÒvñ«ã3ÝâûK©ú(!_£Ëë{ÜæfQMj´-eõjʱô=rÑÓÿ 8ùt*;ª°¬«w[Ôº ib/O¼B!¡zMùìA~;©HqjÜÊOÈ(%NÙÉ9²e5`rlË8ËQP(êqðê-õnÑ*BÒ®>°Y¬°ÓäN·«v«{-3 nÚдâSÖTô[£¤U ^UbkªÒWÍU ¿÷=ÂqíöXÍgäÃß@böÚj¿«/g}¼¢E^ÍÉ`§9µE +!ñµY* Ú<Ü WKjåMj¡Ãu6tá>{賦åö4RδzÖ. N·îc©¼¼hf&!\w ÆRa(®'"ÜÃØö,᢬½ Î7±ÈtmÑ© &µéqjËòðlÄÄÇÏ@PU,E´&¨¶ÖìX`üb&AúÄ®¥µVÁXºíæg ûãDs]¤¼hõ+)FéÐVµu,zóe¨¢¢>VR"زÆ5³r_óñN6é%öQoGs!\ÅòxßèÇÈ3Y±«Âó(å--~KïøbÔ ½e«°'ãJ¯Ûm[qdäLÌÅ¿ÓgXÙbD´fYYøþö¦YP(þºÒ´ âéð©ú)n+ÏÈù¢ºÕ·{¿ç]¢)[&èÂÕSb CùÖ¬ Z§ä Æ`uÛ·*ÈÊZ±[ñÓ$ÛN&DUdÓZõÉéx+ÓPK5|u²uýAÌVÁÛ32¯,ṉÈöÄ--x]YuléRJ¶&Â±× OÓ ÌÄbhfk¦ÊÄBâ;æm,»`OêØ +BÑY@E3ýË cC ?° T1WÖ¼#Tc{ÊÖ«I)´j?¶'Q¥õ2_(}m+£;ͳó²G¿Yä0ÁÄu×ô꨼«Z0ÁÇÅõ'KVZõf U+Éó ÛllÅlEaãÊÈÃÊYÈ ÿ ÿÄ ! 01@A !PQqÿÚ ?zåWÄ!Ü~£¸ÕnDd%L@ëÕUÌATHÉ#_GBâ`oA9ÑH¤Hï÷NTG!àÿÄ + !1 A"02#3@BQaqðÿÚ ?²¯BDÖÄ Öè3 ö»@ `Ƭ5¸ªÞ×tpÂsÃPîZ OÆÈqâ §LLÅÛ¤hç!Á1ùsé5ù <s©1¸ðFá2KåZש{Òºc% xBýê@¿Zr} dóADÒëMx9¡Ü§ Oð¹Pâ1;&?»PúZµ_¤#ÙH]tâ Å dÿ 6Ið"ö_¨¸xä¯^TÄZYr1²YÚù(äp³JõÔ)G¼ø&c_ "2; ()l¸£ÀñÊ=GÇ'²ßnBؽ&1üé#\';Ð6èXm²¾ÏGǹ )ýQ`§r£:40ò n FPê¯ OÙ[PQ³Ò§kݲlO<T=QoóËLáÖ¥ë+ðPÛwEÓ3þwÆÑNF3YÒéÙÛñ@ >ÒhZk Ôu4h.˺N¥¹ ;V¡¸Ü¾·<ÝÍ$8´÷oûL²àòóet¬n9iÔ´fJé ÅDòéÜ¥ÿÄ 5 !1"A Qa02q@¡ð#BR±$3PÁbÑñÿÚ ?`'7,©, Db×lã !À Lùô*x¢ ê tÝ-®å5¬ÝC¢ChÙé·§#ø (gæ YÖÂúØVÈXÛ ´áTçµWÙuÓ;&0tO1o¨B{ôEÜ!}ð®ÀÑÃR»ê«çKͶ=¢&C5²Õe]½VþA 7Q4Ý7¶È½ÆGeADàplÀ}Ô7Ò6Yo·ÀFØÖMù*fͼªsé) »·¥°1~«ùUmzz@ Ðê«ð`(ájC-A_nª ¤ ,8ÙPHØ"î ½þae-»B´2ýL)/Y¨D* ;vòK¥C¥ÚpÊD â.}Í{yÒ º,7P\á h²*Hò§4\Á.?E' ]Tä"Ý0 q:z "¸ThKã(DswòèQºÅ;?nò ¼H¥º ªâcÕÕN£@³WeUP[ß Ð²ÊÐGUNA;óÐDºÈiB.ײÒkEI(=ßMùOF¡J¢à wB£éÍD wYFÄÀQva9Ä*-MHH üæ6C>ê²7\Ä«¢Ú¹½Óª5 =]w~SË1"Ûî³ô^¬ï0!xMv`îÔDþcæ·é¦ Z&êdy¤P¨vÀÈòZ*A*+8ÜVÁ Àè0 ÆnÊ%xfû{¦æVÐÔn¦þÑk½Â¤ùy`¬¶*]^ÊÈw·*Vfí*´D(BNÖUöó=Pø Ú>ÿ ñiÔ$üÑ@ø0ìôT0zcÿ éÈ5ÂxD$R&ÔÃþ]:)Øvh>\ÚÐÊÎ# æÍþKúpÑ·z(ËkBI lðæFÐK;ï @+ð©¬óõUôìU`# 9jí¬sIÜ(*¶älÀüy§QnÉ¥¦» !tSÞU0ùPíèØC>û#@TÍO=H2Aqý*->B'vÖÖYÌ9WHêJ&¥;;`{]ôV)¢ò©«" íJ¦Ìì´ ¸é2ª+('°øμÓYÝJ§¼¢ V$eÜo®_PDGítØo²Ãfë,Ô_±YÞðÓïÙ5º\rGn%¶ÔL*LtS5PØÉüá§êÀV¨Øa 4n\/K¨{FgöEærØþÕý× ÂÒêBým¾SúøÄ @w ¤´oh£·3¹Yx-êïËû§ ½*5ÍYíÑC 8D»ýÕpÜúØHTÒÙë4DíñÔÀNȹ³â8Ìfõæq dl ý¯p«mþ{å~ú§x¹L8åÓdÊíº¿ø<¤D(seÄsÈ©f}ð-ê³8ú¿ÏùG¿DNßRáq6#uxyræ«t äAtcpi0ziú¦°êâpÌÇê¥Ô4ý~ûã_1Z¨"g Xlp¶YÀ¶©9Nè`ýýº£ Æð»b&]a1)¾ ÃGpáÖñI6EÿÄ ) !1AQaqð @¡±0ÁÑáñÿÚ ?! LªûD¨}\ËÄϬu@ÙÌ·CEcÄDj9ñ®µ æó)h?[¿æ´ _m«Þlö>vtx:üøå tÛ0-e1UCLµô¶²xìídçYÌ7FMÛl¦zb ócÞTp»ÕP ©¡³¨gE£/#ÞV®ÕôýÁ´{O橸X<Ec.äLBç å *¥¥kLzFa © +xî/Ñ]ï=så pTÒ Ë #j¤¾9HÔt&Æ ÔʪîQÐv³C GæpAª´¢¼ÿ ³Æ.íÇMöwÔÐøUÄ $it¶% ç´©Û>!úXÖ' µI ªPû7N¼çæ m®åJÂظ`Öþkñ4úó/´Ø¬ ×õ)phÒ bæ3?`U¾ Ô!MëÀD«0 ù&jëe©º£ôáÑn0%$¸=¨H6Òá²cA·åÀ!à Ë~>T¯Â2¹Ù-7)W¬bGÆZ-kAÌlNÔÙoMçäþ¥t6pØWÎ(@BÈ45éßø¹ ÆàסXµ}=à>)»|bCöBTм_>Ñ°*¥ôò%Ê= æv«óqµÉ¦#§Hïë7 ©gµæcÐ rg'YÀ`ÕeÃþe,b¸.%x=QÀÛ ×ñæi´Üʸ zJ0À/l;èaÌ+Uu:é¸q .ÞëÚsÃqD\T9Ä_ÓÚôÅÜ=YDº.#£bùÍ£Füv; 2ÌòêfbªV¿;Aü5 +ÔÕOºµl<Ç¿HV,¤pé ;±lÛï cõVþ7WS4 çõûÒúþãÃ^0X:#0-G'yê0uS)J·ÏÄÎgwazÎú¤qçΡ-Â> ¸»Jgê#eÜ/ÙÂÌï{¹ûg+`-4ñÇzÉ·GþÂZµáR¼6F^!-Ìæï^²¸t)bËï·¦ipbð[7(»Neì<shÖbgJ^ =! Qz@.#ÙÖ RÌ44çé'j¤ »+RÚ@¾÷@¢¿ÝB-Tmô WMüé ,FÚ·ælÄú,/VS¼5Û+h Ü3Ù¦-ý¦M¡+ïÛ',ºËÙø©Àm"q`gÆ/ ïkm\oúRY2év¥²{EQaïQÚ }IR¥xmÝã ¼@¬BëÑ7 Â@|;&7½<λGàwÂ@ /Æ ºà52N3}7¡L©x9üJ¾\TÄë.Äù?¯)ZE/:è^Rëâ Õ%ÈrËôËmP¦¸ ÌN¶¡Iì¿49GHë×Þ»y»áó[Jà+¼J<Äu? ó D§þJkÎصú ãK<´ Ãbj³t1¢ù*l3q ¹ÊTÔFÅÞÇ´Û§hÓt]G^³}¹Ã»SWxy«ÁÅËÄ eGDJî~¤ºÎ??8§ +wpFT©Bk¿ó ÓÔqwGí3¥Ðño/)na8; ¡8Z ¾[Æ yÀRª?gê(_9õ oôí/.ÊìJhååà¿ Dô¯NÀz¯ÏKÎý'Ï´Á^%;Îs@¡¥_Ñ«°NO䥨ÈigD_²Dpñò»@ÕW|Þ +˦Ç6¼K ×<¦]*ÕgY·?¨ÄËYcÿ &+¥[Þï ±jûËëµg Ô=¹8o=&iP&ñá/"ÿ 0ÏR]ø:óX:[''Ï]j$¨ÇªÉ͸Õò·«\w¼ÃAãßÁr]¤ºq»ã0ïlqs$Õs)"ÑÁ/Ö´uÁTZ~j 9 ÝX.:Ä ´7´Ò³¯Ð;xð(4¦§¦`$;ä8ã´r4J]hÿ -£^.|Jp1é=Ü=ûÆq¨÷¬Æ²ÅÙýN r³ ìDrïñÎq*¶JØË9ôïÿ Xå¾~_´Ê[*,.XÉÑéX( ºÊ7YeÈ·vã;fH¹ëµdê[,?ä¬J ~Å úEËðRÚMÇAò~?QÌÊòÊR¿mºkÚHª+hÎ|þq0Eµ«ö·Úq¶Ý §ï´²âÍãáÇ(«Ûí 5;qV&I´°·}Idp¥Nzôcó8±±mhâ·þ°·zÉÛYÏÙ\¸0bÄÑÌÏ¡ø&º'y°¹9 øKN¿ç]yÅdo÷#E2oê'.¬6Vñ¨qxÝÿ ¬À¥r:Kÿ © BZbï ®îåè7 4 õqÖ 8)¢c£Ï§Ó_6Âh «³ÒdªÌ² 8ô`ûCÀ¡ CdåB ^-â 7AXïðò Û^ÃÛã©ÇE§Ô³pÇUZtÓóÚTùº¹±+m¯ Ô±òVÛí5WfÙí£MúBfiÀ0 ûËN ½ ÿ Ø WKíî8ûqà^à ¥N³¬f{'öÃ5$à»ã¤ÈH ×=åÊ û Ûù0Tlº§ã,¨KÌÁô«]ZýÈá¿ 4Õ5¸·2«_âBä{?<_¥JXg :\$\ Ó?ÇÐ~Ôú@ <¦7Vѽù=%BÃbÁ/÷ è²T 3gþ@µ Ö6ÊÕ~GõPXÏ¥~X÷fpǾcA(ó6uöd< Þ4ªßþO(å £O[¯XR s({j QRúD¾JÖØÄ jÞÃt÷w rr7-Á¹k#Fy~8þ b*û" ´//õ[Îe 7໵²(JØ {`Ó²Uä,uõë¿íJ¨Íeã·] Ä n®x¥®qÔ °`Áå]'9`£½ß,5+ I¾ìÉ@*ê72cÈÑáWøß¼¿@ãABÈXçµÎ'>¼ÏÿÚ ºæ³l,]ïÕví´©Ý^ 7üס" t,)û·×4 Ãÿ üÒ¬g½B°`kúÁrc è þÜ;Â¥ÆUvÐl¯ ³vVçÝC S§gÌÃlt¸ÿ 4ËCÓÌa:]v9ãn$÷ ÿ ücvÁ æ3lÜBå WþÃðskº ,0ÿ ÷¬I=d{JH 0ÿ ú¾RïÎôÚ¼¹ß 0 ÿ ˺yËîNÓ ÿ ú"uÐÂ| ÝýðáÿÄ 1 !0AQa@ÿÚ ?ß[^µhnêÝwR½4½ /ÑÕÆÛ¹/j`jlbCt_£]Qé>îóZIÈÕìº'Àey ó¢ÌÁO/må{a6%YÃ67Ù;ôãL4W!s¥q¢puÛÎzn ÒÆ+Àã N9ínº5!£F%èTüãø¼ ÀèùïCSN »Qô9ÖV%«Q ìÑø2!ÿÄ ' !1AQaqð ¡±ÑñáÁÿÚ ?#j¬wó b 0,¸rɳsæD+3W 8ÆND $0¡Ò³ßË9½ñÃÂQFiæ¼ád4;ûÂÛaëÖ"ÌüÂm_ÙÏ}à¬8T©PÍ þ+¯¨ë. ¦¨G·c/ë8 Äau¿çm7à"JÀàÍb% tÏsa¢Ús×î%<ùH< =<ó³wO¾×õýÏFQØ»@¸6¤b¥@@Òó}ÉtW=cG7 Ê&%¯ÀýÍ"í¦|ÇæÈÛÒ´ûÊÔç3ç0E,MrJ̨ìþ¿Ù´Ú½¼òR妽o¦h÷¤º84\l] ¿~$C9+}ü{K UkFs1½höVþöoZ®ß¾yô´iVöVÕ+y@à à¸3E3üuÇuMûvýÿ ";é¾Á zvéÒ sÒ¥ýv¹BÒ¸ÜQÏKúÔ£Ý ¿iU)]ô ¾Z4í£Bj ¯Ö?>ÌK)Û®J»ïûûQVÛRýų= óm;B§5Êó\¢;BülÞÿ ä 85Àà0 !ÖØW.ÛyPé).6M¿gÜ FûÖÞ3îößß5 ÌRäºÿ à¢õãoä eE ±øõYR¦ W7ÍWñ g&M»ôk¬íæºÁVö©¯½¾%ëèsµÙ}ú_㧩¦`ë]ØíéÒ$Gh- Ðô HCÑuKÆSØß±!wPùÎm¼Ö[Uñ®oÄâ H@!Ì|ðP5 ÝñÅüÔGÚÆ5$§ a×è¸; 3¶æÿÄ ( !1AQaq 0¡±ÁðÑáñÿÚ ?ÚYPÙ¼lÈ jðoÏX1 ¬LÀÅ$ÕV¸ x[Ô ¶uo>'^v Ã8}<ËA%J»tÇ]eeDÖ¥i×ù}F0ìµA£nä ôcüf$u Yf'PÖK'è.ÍÜ?wle(6GV骱 ñLº%kÉnøÀr*PTzeN&¯3fÌ58U6 ÷mjÓ¬Þ£b°ï^Ì V)øúh_4Pp;+ z8!º<%ÓÓ8wT2ûøÈY¡#¢S7åï;¸V¬XZ¤Þ_¬ %ì+=d"2ÄHôäÛvëTnH¨ zÁ,iÁ°s¯zÎ0¸ðF×ÊWß {>*¸ãô~ãêa "v C g9]ó5oü8»pè4ÕìáìërG èQß06{Ît`jÐ÷mípä(vd 4o 9\UÓ4üÌ£qÛê³ ~ S*µþ=?³V&%¾ñ)Ü´Üî»ø2o1ªTlô¯Þ!J4§þ¸Uðæ5bk ¥Icw¾g? è 9`x{ÊÝ0Z ¯i½ ÒÆrkTx5®²C ¦×jûUüãöLIö/øA¶¼»õa|SJ#^ß4qpM²A¶ñKùpaF]êU/Å µT,Ö°kte ÁhWnÄpAàßå¸Úb×ÎsGé1 Qj÷Ï÷ÞZª"³e rJþMZÆUOA>²Q[\8ö =æµÇÄ6Æ"+ íw0ÕB¨xXW ô¤"N NÞÜXÐ WÄØ·ÆÆ´øåÈõ xçüc )])Èòõñ?ÊaÇ@ +ý×Æ/ç¡®ü.0e£ å´!(¤nù·úÈ-ì'-øÖÞ t0ðý §qå¾a`M#íÌ ì!Ý-ÿ [nW£A w ¸ ¢+羡£° ´0âHqçMV"¡Rñÿ ÃKªÉÐS7nÓ¡ûh<,G8ÕødµUÄmú?Ê} XÄ ¾WGÎVÊÅ9X|±Àv&áf÷§ûÀ¹1¤5Tä&ÔBLQèk[É@çQe_FPï9sêEUZý3°Çÿ ¹Jg6Më"u¾v£Ú(ä]¸ä ¥¯A S`=å±7iç }'ÒdûÏ¡ôçhñBÐ:ï &È8Ø ó øGâ"+¶í¨SxÓrÖºZ s b*ïS^ñi¦?El´®º UÆ£aQ fýsVájýh.ñ- ¼:u ðµåßwZÞ¶ªÛK9v/(Þë¬vÖ > Únç/¦$,F:õ~ûP<bx¹ÔtÛ¹£xËâ0« rï7 )øúL2}Ç_8Ñ+! 6Ú¸r,j PS¼wåBä-Ë䩾!&Lîj<Ãþ Tå ÉÉÌß¼¶á§Ü`ºg u4¼ßõûÄcÄØ»\m4¶^oo±ï÷á²^ÿ õÀ<2ú-§o%zFmÞP§{vÀ¿Ö Ú ß¾z çDþ±RßCÉGÒF»ß-]â=±ÃwIM¬÷unRΰ 5 Ç>Éõ9ËT«åxÄä ¥ONÚ~2Ò³¤×|ºÈeUÞÊ/;{ÞoRJÈr1yª|õhp#Ûu>õö H°EEÏIÃéøòTÖéF¨ÁÊiØËÉòað,-9W]®;wtätÎ)£Ï#iðûë7ÜtÓÚ=?>2öQ£Æ Ëyº ÞIÞ*ñÜDÙ¾t7r®ùÆ4ªYP9¸ãBÜéøI¼föì¼ÌJ³9ÄZ2¡4ÿ C¯¸îä R^&¾ÒìÀ¡×o¬Zm/r^#ÜO[Xµø5~ yà@!5*i©Ã ´0lJMÛýc ¯J#Û¸¼_ÌÑÏ º p÷Ô©Ö'N>9~¾æ1YëÞ)N Pv8=ÃÀX£ÙÞDö½0þ²xhµk©e³¶^07#XbÐh7ü¯íÁô´UÈ÷¯y@5×m7¾ÿ ÆlY|cf4 #ÞÙ<¡».1c[; û.¶JÒ ¢ñÞ!5 qv£ë\c¡>Ä¿X» JQ,¿úÍ¢ ¨Í-y×;-p⨿î'Ç_`еh»S÷HXB¨ÜfF^À¬|Ðq ½b¥9]|9?N0 ºã§ë&ah"é£wy± ë7C=â#¿¡µveëxûL,Ó¢¿ÆjLº35Þç§N°ôJñGýw«öD`'C£PçwOb ±I >üô ºïTÝ[û"(4ok=zýcâCR´ürÌ J- Pb IÒn`pä!¬ÎÙ"kª éÃÏ go8þ5 Äk`üäÑ©¹ãÓÇÆ5·§<â²°Îf =cÀsÙJig/ýZ(ä$?èaÚòÎ:ÍÂ:ÏÁzÕ°Äwtë$¸´g5È>±/9êúû}-%xswÆ°U5qAäìd{ %wÜ ]»?["¥!VÕ<Që dy?!l ¥U yÎ$¤ §rä: ý®¦ 8´1Á}ººÎ»«¡°ðìÞ'¤@U`½ ]HL¥NFAï¬EeA5wäãúñ5&Æ"i,i,ÙAÅ ©Êù$]Áäo{ØÐ,D_nvN4â²> ΰ Ö \zÍ À"Ĩ/Ê)&×Þ,Hf]ÅIÙ>I¾xÎ_a _ð?¬3ñwè'ßÐË1E HµäÐìÞËf\¿Kô Îc "(¯ Èî c¡#¹ûׯe P;! ÎÄãQÁ!Ä8¨I±#R${íó×ïo8¿×åÁBT-Á£i#¨ÚYa«;?}e ªãÝ`Ð ¸Ðb>qGY -ßÐÀ;Ãq²ö[ ãóÖêb"°ð¼3pT ¢+jﶢ\¥£ã=fí÷8'ÞL,ÒÏûÌ0Ó SÆVh -êÁw®Ù8¸ çIãTï| ¼ã#wDÒ inë®<Í¡Â tþZ5ѳÃRÃG5n@2"pIEÆ£ÂhÝ8ÈÕ·bë}» x[ ©ÖuÖöL V§¿ü ñß*3ã>X;r<Hïdzç; @nqªõà<´åÆ}À|zá© ¡(l£W·Þ ,!¥Dy NN]Ñ }a'Û~þ˶æHÖ¢<®ø1Pízt¥äº\o'è D«v³84óØ4tĺG" UâöÃÖ2 ´\Ópó ` nʶaLà0-þ;d^c®®"Ä*´ èrñtæºÄÒ&¸zæz|Õ]R þ{®3 ¥ÌúÆ¶É ½¥5)°pYº¼`cçpUík?4ßt¦ åè,!¿ß]æë¬! ×nî×ÆRK©¿9fèÉ]*k¼*°u(·_?Ã*HEéÌ#¡Cóɳ ùlÍ7fÙÞÇÍ˽á}0«ã5ia©_ÞPå´Ù'#4[ÛE¸ú´72° t¥uþùÿ J:"p»oø¥ô ¾ lE`ôj¬õ 7Áª6öv ýƼå4ÕÍ?@Inß(õ}G%Ø·½¬LUàÃÏ Þ5 ë- ú ÐwÈw0% {që*al¹E _Éà1GZÅ ºþC .Ø~W÷ôÆKAéáéÇB'# ;Û¹AªäEOkgq/!EËá ñ^¸}%Ãm½F´x©;Î:A®°çæOÞ¨LÂè@pºãN¼¹+jÒhTºp{ãUMìÚx®, X)S¾1ªA%äßâ1l+c ´=ä ظzsqþ1¸÷qu+¦Èæ ÀP\Ð-Q¡uJ¢lãýYN©Ië£Væ<úô©®¶¶ Ä|½õ¨¥Mà;YüÝ~ W-æP] 4ýb<à^u6gÿ Îfhæ¹Ì¶Ú<nÀ¹ lP6 Á®j»¸orgtÏQMÇã7q){lã DÜ°Bð* Ú¸IKÏ /++(½0ÕÈ#ÀA$Ù ò[ã Uâ x¡IÆ+Ë [;U¢¶ÏGY¿-æIÀñn£¬E!"Úç³PÐ%Qj©X:Ö¬ ?"â¼ ix"§ò hógqÆTò"jïÌù`(zÑø »b¼ùPò;0·ñ:Àì á µH-EÑJõ¬x Ar<P[u¢ U ®À º<t»Í§ÍAy¹)6ê÷É R[µèñtE ®Î>1d;^|ÝÉõ\%¨®xÆS!KAB(ÝTÚO BT¢ tÍ ²°âë$d EH«WM¦ÂÞNnßRÄ«½â A®¢#±ÝOç>ÅLQr ÍÈA)OÈã-Àè> ò~ÌwDèZ9äù9Ç÷³\s¶ïÿ q.DL íé@(òh æÆÁG} PÕ¡°Héz"©Yde%ØÊ)| èl=|d¦ÓPHàA!¼ôÅF°ÅAc`ä¶Æ#sE5£½(/63´UÛ5VØò±ÍªÊÃh q¿n1Dj ñÆ ÃùO¡övÃOÑÓYÐâÜÉ~14ÜUC¼¢ÃúHâè%M;óƯ¹r Ø(= 8/Ï£Z< éCN4 m^³dº¼Å(®WX ºÛwÎí¹Á¦MTJåãËç.× ¨ ÂΡkÛhë¼û¡övú÷ú\ÅàøÂÓã$¬QU^71Àë@ Î[äi0ó½ªXKj0)ek¥°ÜÕèuo t&´òíN°µÊ?X¸3Åþcè} 5øú_86¸+ñðs£¬àֿά^®®9·eSN·Ðk7Æq <9âÞ92üèéCedÓß÷0!4bÀoº}37B¾ö 7Á BËUgà±fôpñd F¾>pÌLæûÏä=¸¯ÆhÑ\ Ã:ý?ç+êk Ûæ&÷²z¶ ï«çc ¬ÛÑ!Ð ,cz&æNÚAð <lµE¡Â` ÚÕ ¯ ëÔ5^ñgCy_$@XÊ¢j´d+"Ä$¾$CºR *î$¥<@8a91d `OùϨ¯¬EAg#¥%ÔѮἠM!Ñfü5ïÆ @0Nóå3B¨Ð¨(] PÀ(±ÙJïõ .(ÄÖÑĤé2 7]ÀÔV4./+£k?ïÎ7´@ðÞ Hl ÏbË[= ï'% ¡_8Î\|ÉÓ0/t hJÙ£UQ'븶ØOayÀ Á8 TÞ7 !£.(V¤`fs½Ùh)PTìíºç?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg&size=160 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/1.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 12426 |
| Response Body - size: 12,426 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ù¬ÄìóÛÏ»)¡¢Øéʧç¢Úêôã,y3e®êÀ &ùcÑ[Kôá¶Z8Û! }cÕêóèÝ$óPLeí0¯ ô3]Gª¦¼ûåëÏqµÅU¼$ÅA1 LNù)öUvèÁ÷ôÜ*Umðwk¶«"$ Ëm6äg©> ô:ÛÄ`bj3ÝOIÄI,D LMNû553ëOW 1ñ¾c?¨KéÀÒ "ÓvÊßdyó-<Ò¡Ç2Õ ½M!²Ç]'Ùêìvj²b 4Æi{tøj(Ñ_¥\Ù_ÐÆxï 0çM¦Þ¥ØcÇ t1Saè6ù¦xµ5Ó¹ÝÕoô¨°Á˵ÝmÖÚ<É«- ÇVjrvký¸oò]lÅ]Ñn.ÑM7×ÚVu}ðqÚùæfÀÉ^A£>Úi¹MzK0äç_dïÏx4ñ7¨ÁíÌ¡ô¹öåcZj»²¸ì"fN«²V²½¬6Fâ¯-AFÜ~ÌÕ]¼GaÕrH"H*H9gMÌÒz|¶Å)8Öפw¹¹o:xÔ9}2_D_GËuºÍ±\ötXã#W»:ãæmbg*¾®3ólnWdÞ&Í *zäÑëtEÙ3Ù³?D§§¼\÷ϤéSo&¹¾ôÞmN?C×I\,ë(ë¹é:|NkÈ㿲'ÕÛ K]¤ßÎù 9P ° ¢`Ó¸I¶¢½FõE³Lê7Ýçubú§/µ¦rs´tÎ4GO ÍÚ(Ó͵î¹ù=fÛOÖçF½Z|ÚÈlë ùñÞ T4LHÔñÕo]ØߥVËèVf2{/=q ³&ÀÓ5}OYÓ_;ÅÜUÙ , &&*@Ð:î»»¯²Îë°²ê,4ßA¯V]~mYÖm/uSzÿ £i}yÓkçÐ ÄM hu XvI=óa6òÖ\1ÌtÓ»>~£qbÜa·ßíë?ÊéR÷J¾§<µé¯´óày´@ PD jlØ ®NC¬ëpbØÄ0ÑHyõ²ùúЬ>3Ú ¼±ãôë{sÕ! ÿÄ ( !"01@$#23ÿÚ £ÍÜÀ¦7b 0ÿ ·Í4¹Úºµ°°E2« (ê tW.Vê×Ó »½Ýª¶£óÿ ´lM_äºßÊD ±P8ïùR,ZU»Î[íÓGæ®Hmö¼E°£;ìÄö¸Z©[õJ[ªo¦ÁOXÿ ß%G@eo´Ú~ÚBF»^^ËÊØy^V¹0÷;áàq¸ö ë¹n6\§µgúÚdÕÇ[v ~ÇU©o^N¤Ù¡î¹°l¼3)¸¤[°«z0ZÇGto¿uf$ÒA±0<c¥_RÛXTºfBÐ"ÊjÄÿ ê6 !ô©} < ]RÃJNkmgÑULëÇ_{Ø%{J.ñÓÒ ÕÄZË|ÓVî?XPé]-[ìzXQ?@_Æ¢ç,ÙßÓ k½Ãt¿k(VZîÃ0ù [}u¡bÜr°PÒvñ«ã3ÝâûK©ú(!_£Ëë{ÜæfQMj´-eõjʱô=rÑÓÿ 8ùt*;ª°¬«w[Ôº ib/O¼B!¡zMùìA~;©HqjÜÊOÈ(%NÙÉ9²e5`rlË8ËQP(êqðê-õnÑ*BÒ®>°Y¬°ÓäN·«v«{-3 nÚдâSÖTô[£¤U ^UbkªÒWÍU ¿÷=ÂqíöXÍgäÃß@böÚj¿«/g}¼¢E^ÍÉ`§9µE +!ñµY* Ú<Ü WKjåMj¡Ãu6tá>{賦åö4RδzÖ. N·îc©¼¼hf&!\w ÆRa(®'"ÜÃØö,᢬½ Î7±ÈtmÑ© &µéqjËòðlÄÄÇÏ@PU,E´&¨¶ÖìX`üb&AúÄ®¥µVÁXºíæg ûãDs]¤¼hõ+)FéÐVµu,zóe¨¢¢>VR"زÆ5³r_óñN6é%öQoGs!\ÅòxßèÇÈ3Y±«Âó(å--~KïøbÔ ½e«°'ãJ¯Ûm[qdäLÌÅ¿ÓgXÙbD´fYYøþö¦YP(þºÒ´ âéð©ú)n+ÏÈù¢ºÕ·{¿ç]¢)[&èÂÕSb CùÖ¬ Z§ä Æ`uÛ·*ÈÊZ±[ñÓ$ÛN&DUdÓZõÉéx+ÓPK5|u²uýAÌVÁÛ32¯,ṉÈöÄ--x]YuléRJ¶&Â±× OÓ ÌÄbhfk¦ÊÄBâ;æm,»`OêØ +BÑY@E3ýË cC ?° T1WÖ¼#Tc{ÊÖ«I)´j?¶'Q¥õ2_(}m+£;ͳó²G¿Yä0ÁÄu×ô꨼«Z0ÁÇÅõ'KVZõf U+Éó ÛllÅlEaãÊÈÃÊYÈ ÿ ÿÄ ! 01@A !PQqÿÚ ?zåWÄ!Ü~£¸ÕnDd%L@ëÕUÌATHÉ#_GBâ`oA9ÑH¤Hï÷NTG!àÿÄ + !1 A"02#3@BQaqðÿÚ ?²¯BDÖÄ Öè3 ö»@ `Ƭ5¸ªÞ×tpÂsÃPîZ OÆÈqâ §LLÅÛ¤hç!Á1ùsé5ù <s©1¸ðFá2KåZש{Òºc% xBýê@¿Zr} dóADÒëMx9¡Ü§ Oð¹Pâ1;&?»PúZµ_¤#ÙH]tâ Å dÿ 6Ið"ö_¨¸xä¯^TÄZYr1²YÚù(äp³JõÔ)G¼ø&c_ "2; ()l¸£ÀñÊ=GÇ'²ßnBؽ&1üé#\';Ð6èXm²¾ÏGǹ )ýQ`§r£:40ò n FPê¯ OÙ[PQ³Ò§kݲlO<T=QoóËLáÖ¥ë+ðPÛwEÓ3þwÆÑNF3YÒéÙÛñ@ >ÒhZk Ôu4h.˺N¥¹ ;V¡¸Ü¾·<ÝÍ$8´÷oûL²àòóet¬n9iÔ´fJé ÅDòéÜ¥ÿÄ 5 !1"A Qa02q@¡ð#BR±$3PÁbÑñÿÚ ?`'7,©, Db×lã !À Lùô*x¢ ê tÝ-®å5¬ÝC¢ChÙé·§#ø (gæ YÖÂúØVÈXÛ ´áTçµWÙuÓ;&0tO1o¨B{ôEÜ!}ð®ÀÑÃR»ê«çKͶ=¢&C5²Õe]½VþA 7Q4Ý7¶È½ÆGeADàplÀ}Ô7Ò6Yo·ÀFØÖMù*fͼªsé) »·¥°1~«ùUmzz@ Ðê«ð`(ájC-A_nª ¤ ,8ÙPHØ"î ½þae-»B´2ýL)/Y¨D* ;vòK¥C¥ÚpÊD â.}Í{yÒ º,7P\á h²*Hò§4\Á.?E' ]Tä"Ý0 q:z "¸ThKã(DswòèQºÅ;?nò ¼H¥º ªâcÕÕN£@³WeUP[ß Ð²ÊÐGUNA;óÐDºÈiB.ײÒkEI(=ßMùOF¡J¢à wB£éÍD wYFÄÀQva9Ä*-MHH üæ6C>ê²7\Ä«¢Ú¹½Óª5 =]w~SË1"Ûî³ô^¬ï0!xMv`îÔDþcæ·é¦ Z&êdy¤P¨vÀÈòZ*A*+8ÜVÁ Àè0 ÆnÊ%xfû{¦æVÐÔn¦þÑk½Â¤ùy`¬¶*]^ÊÈw·*Vfí*´D(BNÖUöó=Pø Ú>ÿ ñiÔ$üÑ@ø0ìôT0zcÿ éÈ5ÂxD$R&ÔÃþ]:)Øvh>\ÚÐÊÎ# æÍþKúpÑ·z(ËkBI lðæFÐK;ï @+ð©¬óõUôìU`# 9jí¬sIÜ(*¶älÀüy§QnÉ¥¦» !tSÞU0ùPíèØC>û#@TÍO=H2Aqý*->B'vÖÖYÌ9WHêJ&¥;;`{]ôV)¢ò©«" íJ¦Ìì´ ¸é2ª+('°øμÓYÝJ§¼¢ V$eÜo®_PDGítØo²Ãfë,Ô_±YÞðÓïÙ5º\rGn%¶ÔL*LtS5PØÉüá§êÀV¨Øa 4n\/K¨{FgöEærØþÕý× ÂÒêBým¾SúøÄ @w ¤´oh£·3¹Yx-êïËû§ ½*5ÍYíÑC 8D»ýÕpÜúØHTÒÙë4DíñÔÀNȹ³â8Ìfõæq dl ý¯p«mþ{å~ú§x¹L8åÓdÊíº¿ø<¤D(seÄsÈ©f}ð-ê³8ú¿ÏùG¿DNßRáq6#uxyræ«t äAtcpi0ziú¦°êâpÌÇê¥Ô4ý~ûã_1Z¨"g Xlp¶YÀ¶©9Nè`ýýº£ Æð»b&]a1)¾ ÃGpáÖñI6EÿÄ ) !1AQaqð @¡±0ÁÑáñÿÚ ?! LªûD¨}\ËÄϬu@ÙÌ·CEcÄDj9ñ®µ æó)h?[¿æ´ _m«Þlö>vtx:üøå tÛ0-e1UCLµô¶²xìídçYÌ7FMÛl¦zb ócÞTp»ÕP ©¡³¨gE£/#ÞV®ÕôýÁ´{O橸X<Ec.äLBç å *¥¥kLzFa © +xî/Ñ]ï=så pTÒ Ë #j¤¾9HÔt&Æ ÔʪîQÐv³C GæpAª´¢¼ÿ ³Æ.íÇMöwÔÐøUÄ $it¶% ç´©Û>!úXÖ' µI ªPû7N¼çæ m®åJÂظ`Öþkñ4úó/´Ø¬ ×õ)phÒ bæ3?`U¾ Ô!MëÀD«0 ù&jëe©º£ôáÑn0%$¸=¨H6Òá²cA·åÀ!à Ë~>T¯Â2¹Ù-7)W¬bGÆZ-kAÌlNÔÙoMçäþ¥t6pØWÎ(@BÈ45éßø¹ ÆàסXµ}=à>)»|bCöBTм_>Ñ°*¥ôò%Ê= æv«óqµÉ¦#§Hïë7 ©gµæcÐ rg'YÀ`ÕeÃþe,b¸.%x=QÀÛ ×ñæi´Üʸ zJ0À/l;èaÌ+Uu:é¸q .ÞëÚsÃqD\T9Ä_ÓÚôÅÜ=YDº.#£bùÍ£Füv; 2ÌòêfbªV¿;Aü5 +ÔÕOºµl<Ç¿HV,¤pé ;±lÛï cõVþ7WS4 çõûÒúþãÃ^0X:#0-G'yê0uS)J·ÏÄÎgwazÎú¤qçΡ-Â> ¸»Jgê#eÜ/ÙÂÌï{¹ûg+`-4ñÇzÉ·GþÂZµáR¼6F^!-Ìæï^²¸t)bËï·¦ipbð[7(»Neì<shÖbgJ^ =! Qz@.#ÙÖ RÌ44çé'j¤ »+RÚ@¾÷@¢¿ÝB-Tmô WMüé ,FÚ·ælÄú,/VS¼5Û+h Ü3Ù¦-ý¦M¡+ïÛ',ºËÙø©Àm"q`gÆ/ ïkm\oúRY2év¥²{EQaïQÚ }IR¥xmÝã ¼@¬BëÑ7 Â@|;&7½<λGàwÂ@ /Æ ºà52N3}7¡L©x9üJ¾\TÄë.Äù?¯)ZE/:è^Rëâ Õ%ÈrËôËmP¦¸ ÌN¶¡Iì¿49GHë×Þ»y»áó[Jà+¼J<Äu? ó D§þJkÎصú ãK<´ Ãbj³t1¢ù*l3q ¹ÊTÔFÅÞÇ´Û§hÓt]G^³}¹Ã»SWxy«ÁÅËÄ eGDJî~¤ºÎ??8§ +wpFT©Bk¿ó ÓÔqwGí3¥Ðño/)na8; ¡8Z ¾[Æ yÀRª?gê(_9õ oôí/.ÊìJhååà¿ Dô¯NÀz¯ÏKÎý'Ï´Á^%;Îs@¡¥_Ñ«°NO䥨ÈigD_²Dpñò»@ÕW|Þ +˦Ç6¼K ×<¦]*ÕgY·?¨ÄËYcÿ &+¥[Þï ±jûËëµg Ô=¹8o=&iP&ñá/"ÿ 0ÏR]ø:óX:[''Ï]j$¨ÇªÉ͸Õò·«\w¼ÃAãßÁr]¤ºq»ã0ïlqs$Õs)"ÑÁ/Ö´uÁTZ~j 9 ÝX.:Ä ´7´Ò³¯Ð;xð(4¦§¦`$;ä8ã´r4J]hÿ -£^.|Jp1é=Ü=ûÆq¨÷¬Æ²ÅÙýN r³ ìDrïñÎq*¶JØË9ôïÿ Xå¾~_´Ê[*,.XÉÑéX( ºÊ7YeÈ·vã;fH¹ëµdê[,?ä¬J ~Å úEËðRÚMÇAò~?QÌÊòÊR¿mºkÚHª+hÎ|þq0Eµ«ö·Úq¶Ý §ï´²âÍãáÇ(«Ûí 5;qV&I´°·}Idp¥Nzôcó8±±mhâ·þ°·zÉÛYÏÙ\¸0bÄÑÌÏ¡ø&º'y°¹9 øKN¿ç]yÅdo÷#E2oê'.¬6Vñ¨qxÝÿ ¬À¥r:Kÿ © BZbï ®îåè7 4 õqÖ 8)¢c£Ï§Ó_6Âh «³ÒdªÌ² 8ô`ûCÀ¡ CdåB ^-â 7AXïðò Û^ÃÛã©ÇE§Ô³pÇUZtÓóÚTùº¹±+m¯ Ô±òVÛí5WfÙí£MúBfiÀ0 ûËN ½ ÿ Ø WKíî8ûqà^à ¥N³¬f{'öÃ5$à»ã¤ÈH ×=åÊ û Ûù0Tlº§ã,¨KÌÁô«]ZýÈá¿ 4Õ5¸·2«_âBä{?<_¥JXg :\$\ Ó?ÇÐ~Ôú@ <¦7Vѽù=%BÃbÁ/÷ è²T 3gþ@µ Ö6ÊÕ~GõPXÏ¥~X÷fpǾcA(ó6uöd< Þ4ªßþO(å £O[¯XR s({j QRúD¾JÖØÄ jÞÃt÷w rr7-Á¹k#Fy~8þ b*û" ´//õ[Îe 7໵²(JØ {`Ó²Uä,uõë¿íJ¨Íeã·] Ä n®x¥®qÔ °`Áå]'9`£½ß,5+ I¾ìÉ@*ê72cÈÑáWøß¼¿@ãABÈXçµÎ'>¼ÏÿÚ ºæ³l,]ïÕví´©Ý^ 7üס" t,)û·×4 Ãÿ üÒ¬g½B°`kúÁrc è þÜ;Â¥ÆUvÐl¯ ³vVçÝC S§gÌÃlt¸ÿ 4ËCÓÌa:]v9ãn$÷ ÿ ücvÁ æ3lÜBå WþÃðskº ,0ÿ ÷¬I=d{JH 0ÿ ú¾RïÎôÚ¼¹ß 0 ÿ ˺yËîNÓ ÿ ú"uÐÂ| ÝýðáÿÄ 1 !0AQa@ÿÚ ?ß[^µhnêÝwR½4½ /ÑÕÆÛ¹/j`jlbCt_£]Qé>îóZIÈÕìº'Àey ó¢ÌÁO/må{a6%YÃ67Ù;ôãL4W!s¥q¢puÛÎzn ÒÆ+Àã N9ínº5!£F%èTüãø¼ ÀèùïCSN »Qô9ÖV%«Q ìÑø2!ÿÄ ' !1AQaqð ¡±ÑñáÁÿÚ ?#j¬wó b 0,¸rɳsæD+3W 8ÆND $0¡Ò³ßË9½ñÃÂQFiæ¼ád4;ûÂÛaëÖ"ÌüÂm_ÙÏ}à¬8T©PÍ þ+¯¨ë. ¦¨G·c/ë8 Äau¿çm7à"JÀàÍb% tÏsa¢Ús×î%<ùH< =<ó³wO¾×õýÏFQØ»@¸6¤b¥@@Òó}ÉtW=cG7 Ê&%¯ÀýÍ"í¦|ÇæÈÛÒ´ûÊÔç3ç0E,MrJ̨ìþ¿Ù´Ú½¼òR妽o¦h÷¤º84\l] ¿~$C9+}ü{K UkFs1½höVþöoZ®ß¾yô´iVöVÕ+y@à à¸3E3üuÇuMûvýÿ ";é¾Á zvéÒ sÒ¥ýv¹BÒ¸ÜQÏKúÔ£Ý ¿iU)]ô ¾Z4í£Bj ¯Ö?>ÌK)Û®J»ïûûQVÛRýų= óm;B§5Êó\¢;BülÞÿ ä 85Àà0 !ÖØW.ÛyPé).6M¿gÜ FûÖÞ3îößß5 ÌRäºÿ à¢õãoä eE ±øõYR¦ W7ÍWñ g&M»ôk¬íæºÁVö©¯½¾%ëèsµÙ}ú_㧩¦`ë]ØíéÒ$Gh- Ðô HCÑuKÆSØß±!wPùÎm¼Ö[Uñ®oÄâ H@!Ì|ðP5 ÝñÅüÔGÚÆ5$§ a×è¸; 3¶æÿÄ ( !1AQaq 0¡±ÁðÑáñÿÚ ?ÚYPÙ¼lÈ jðoÏX1 ¬LÀÅ$ÕV¸ x[Ô ¶uo>'^v Ã8}<ËA%J»tÇ]eeDÖ¥i×ù}F0ìµA£nä ôcüf$u Yf'PÖK'è.ÍÜ?wle(6GV骱 ñLº%kÉnøÀr*PTzeN&¯3fÌ58U6 ÷mjÓ¬Þ£b°ï^Ì V)øúh_4Pp;+ z8!º<%ÓÓ8wT2ûøÈY¡#¢S7åï;¸V¬XZ¤Þ_¬ %ì+=d"2ÄHôäÛvëTnH¨ zÁ,iÁ°s¯zÎ0¸ðF×ÊWß {>*¸ãô~ãêa "v C g9]ó5oü8»pè4ÕìáìërG èQß06{Ît`jÐ÷mípä(vd 4o 9\UÓ4üÌ£qÛê³ ~ S*µþ=?³V&%¾ñ)Ü´Üî»ø2o1ªTlô¯Þ!J4§þ¸Uðæ5bk ¥Icw¾g? è 9`x{ÊÝ0Z ¯i½ ÒÆrkTx5®²C ¦×jûUüãöLIö/øA¶¼»õa|SJ#^ß4qpM²A¶ñKùpaF]êU/Å µT,Ö°kte ÁhWnÄpAàßå¸Úb×ÎsGé1 Qj÷Ï÷ÞZª"³e rJþMZÆUOA>²Q[\8ö =æµÇÄ6Æ"+ íw0ÕB¨xXW ô¤"N NÞÜXÐ WÄØ·ÆÆ´øåÈõ xçüc )])Èòõñ?ÊaÇ@ +ý×Æ/ç¡®ü.0e£ å´!(¤nù·úÈ-ì'-øÖÞ t0ðý §qå¾a`M#íÌ ì!Ý-ÿ [nW£A w ¸ ¢+羡£° ´0âHqçMV"¡Rñÿ ÃKªÉÐS7nÓ¡ûh<,G8ÕødµUÄmú?Ê} XÄ ¾WGÎVÊÅ9X|±Àv&áf÷§ûÀ¹1¤5Tä&ÔBLQèk[É@çQe_FPï9sêEUZý3°Çÿ ¹Jg6Më"u¾v£Ú(ä]¸ä ¥¯A S`=å±7iç }'ÒdûÏ¡ôçhñBÐ:ï &È8Ø ó øGâ"+¶í¨SxÓrÖºZ s b*ïS^ñi¦?El´®º UÆ£aQ fýsVájýh.ñ- ¼:u ðµåßwZÞ¶ªÛK9v/(Þë¬vÖ > Únç/¦$,F:õ~ûP<bx¹ÔtÛ¹£xËâ0« rï7 )øúL2}Ç_8Ñ+! 6Ú¸r,j PS¼wåBä-Ë䩾!&Lîj<Ãþ Tå ÉÉÌß¼¶á§Ü`ºg u4¼ßõûÄcÄØ»\m4¶^oo±ï÷á²^ÿ õÀ<2ú-§o%zFmÞP§{vÀ¿Ö Ú ß¾z çDþ±RßCÉGÒF»ß-]â=±ÃwIM¬÷unRΰ 5 Ç>Éõ9ËT«åxÄä ¥ONÚ~2Ò³¤×|ºÈeUÞÊ/;{ÞoRJÈr1yª|õhp#Ûu>õö H°EEÏIÃéøòTÖéF¨ÁÊiØËÉòað,-9W]®;wtätÎ)£Ï#iðûë7ÜtÓÚ=?>2öQ£Æ Ëyº ÞIÞ*ñÜDÙ¾t7r®ùÆ4ªYP9¸ãBÜéøI¼föì¼ÌJ³9ÄZ2¡4ÿ C¯¸îä R^&¾ÒìÀ¡×o¬Zm/r^#ÜO[Xµø5~ yà@!5*i©Ã ´0lJMÛýc ¯J#Û¸¼_ÌÑÏ º p÷Ô©Ö'N>9~¾æ1YëÞ)N Pv8=ÃÀX£ÙÞDö½0þ²xhµk©e³¶^07#XbÐh7ü¯íÁô´UÈ÷¯y@5×m7¾ÿ ÆlY|cf4 #ÞÙ<¡».1c[; û.¶JÒ ¢ñÞ!5 qv£ë\c¡>Ä¿X» JQ,¿úÍ¢ ¨Í-y×;-p⨿î'Ç_`еh»S÷HXB¨ÜfF^À¬|Ðq ½b¥9]|9?N0 ºã§ë&ah"é£wy± ë7C=â#¿¡µveëxûL,Ó¢¿ÆjLº35Þç§N°ôJñGýw«öD`'C£PçwOb ±I >üô ºïTÝ[û"(4ok=zýcâCR´ürÌ J- Pb IÒn`pä!¬ÎÙ"kª éÃÏ go8þ5 Äk`üäÑ©¹ãÓÇÆ5·§<â²°Îf =cÀsÙJig/ýZ(ä$?èaÚòÎ:ÍÂ:ÏÁzÕ°Äwtë$¸´g5È>±/9êúû}-%xswÆ°U5qAäìd{ %wÜ ]»?["¥!VÕ<Që dy?!l ¥U yÎ$¤ §rä: ý®¦ 8´1Á}ººÎ»«¡°ðìÞ'¤@U`½ ]HL¥NFAï¬EeA5wäãúñ5&Æ"i,i,ÙAÅ ©Êù$]Áäo{ØÐ,D_nvN4â²> ΰ Ö \zÍ À"Ĩ/Ê)&×Þ,Hf]ÅIÙ>I¾xÎ_a _ð?¬3ñwè'ßÐË1E HµäÐìÞËf\¿Kô Îc "(¯ Èî c¡#¹ûׯe P;! ÎÄãQÁ!Ä8¨I±#R${íó×ïo8¿×åÁBT-Á£i#¨ÚYa«;?}e ªãÝ`Ð ¸Ðb>qGY -ßÐÀ;Ãq²ö[ ãóÖêb"°ð¼3pT ¢+jﶢ\¥£ã=fí÷8'ÞL,ÒÏûÌ0Ó SÆVh -êÁw®Ù8¸ çIãTï| ¼ã#wDÒ inë®<Í¡Â tþZ5ѳÃRÃG5n@2"pIEÆ£ÂhÝ8ÈÕ·bë}» x[ ©ÖuÖöL V§¿ü ñß*3ã>X;r<Hïdzç; @nqªõà<´åÆ}À|zá© ¡(l£W·Þ ,!¥Dy NN]Ñ }a'Û~þ˶æHÖ¢<®ø1Pízt¥äº\o'è D«v³84óØ4tĺG" UâöÃÖ2 ´\Ópó ` nʶaLà0-þ;d^c®®"Ä*´ èrñtæºÄÒ&¸zæz|Õ]R þ{®3 ¥ÌúÆ¶É ½¥5)°pYº¼`cçpUík?4ßt¦ åè,!¿ß]æë¬! ×nî×ÆRK©¿9fèÉ]*k¼*°u(·_?Ã*HEéÌ#¡Cóɳ ùlÍ7fÙÞÇÍ˽á}0«ã5ia©_ÞPå´Ù'#4[ÛE¸ú´72° t¥uþùÿ J:"p»oø¥ô ¾ lE`ôj¬õ 7Áª6öv ýƼå4ÕÍ?@Inß(õ}G%Ø·½¬LUàÃÏ Þ5 ë- ú ÐwÈw0% {që*al¹E _Éà1GZÅ ºþC .Ø~W÷ôÆKAéáéÇB'# ;Û¹AªäEOkgq/!EËá ñ^¸}%Ãm½F´x©;Î:A®°çæOÞ¨LÂè@pºãN¼¹+jÒhTºp{ãUMìÚx®, X)S¾1ªA%äßâ1l+c ´=ä ظzsqþ1¸÷qu+¦Èæ ÀP\Ð-Q¡uJ¢lãýYN©Ië£Væ<úô©®¶¶ Ä|½õ¨¥Mà;YüÝ~ W-æP] 4ýb<à^u6gÿ Îfhæ¹Ì¶Ú<nÀ¹ lP6 Á®j»¸orgtÏQMÇã7q){lã DÜ°Bð* Ú¸IKÏ /++(½0ÕÈ#ÀA$Ù ò[ã Uâ x¡IÆ+Ë [;U¢¶ÏGY¿-æIÀñn£¬E!"Úç³PÐ%Qj©X:Ö¬ ?"â¼ ix"§ò hógqÆTò"jïÌù`(zÑø »b¼ùPò;0·ñ:Àì á µH-EÑJõ¬x Ar<P[u¢ U ®À º<t»Í§ÍAy¹)6ê÷É R[µèñtE ®Î>1d;^|ÝÉõ\%¨®xÆS!KAB(ÝTÚO BT¢ tÍ ²°âë$d EH«WM¦ÂÞNnßRÄ«½â A®¢#±ÝOç>ÅLQr ÍÈA)OÈã-Àè> ò~ÌwDèZ9äù9Ç÷³\s¶ïÿ q.DL íé@(òh æÆÁG} PÕ¡°Héz"©Yde%ØÊ)| èl=|d¦ÓPHàA!¼ôÅF°ÅAc`ä¶Æ#sE5£½(/63´UÛ5VØò±ÍªÊÃh q¿n1Dj ñÆ ÃùO¡övÃOÑÓYÐâÜÉ~14ÜUC¼¢ÃúHâè%M;óƯ¹r Ø(= 8/Ï£Z< éCN4 m^³dº¼Å(®WX ºÛwÎí¹Á¦MTJåãËç.× ¨ ÂΡkÛhë¼û¡övú÷ú\ÅàøÂÓã$¬QU^71Àë@ Î[äi0ó½ªXKj0)ek¥°ÜÕèuo t&´òíN°µÊ?X¸3Åþcè} 5øú_86¸+ñðs£¬àֿά^®®9·eSN·Ðk7Æq <9âÞ92üèéCedÓß÷0!4bÀoº}37B¾ö 7Á BËUgà±fôpñd F¾>pÌLæûÏä=¸¯ÆhÑ\ Ã:ý?ç+êk Ûæ&÷²z¶ ï«çc ¬ÛÑ!Ð ,cz&æNÚAð <lµE¡Â` ÚÕ ¯ ëÔ5^ñgCy_$@XÊ¢j´d+"Ä$¾$CºR *î$¥<@8a91d `OùϨ¯¬EAg#¥%ÔѮἠM!Ñfü5ïÆ @0Nóå3B¨Ð¨(] PÀ(±ÙJïõ .(ÄÖÑĤé2 7]ÀÔV4./+£k?ïÎ7´@ðÞ Hl ÏbË[= ï'% ¡_8Î\|ÉÓ0/t hJÙ£UQ'븶ØOayÀ Á8 TÞ7 !£.(V¤`fs½Ùh)PTìíºç?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 3324 |
| Response Body - size: 3,324 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ø#»)Ó\ùÎMI¸± ©b@ Õ¼äT½y÷éäã¼ó×#=ÒÉ`h X©`PP T× .5ß~.|ºc=ó5w¤Ô@ ©¨±A@Ø×¥¸YY½¹véäãã=àÏ\¬É P X©uW\åV㧣ÍׯÏÇ-ã ¼¬Çvum(ËRj ×.Zó×£^>YÇ«+3Ö,Y-EX éuzxòÑ%¶ó½¹uéãáÌz±ÌõËRo"tËRj "©dÐËQb±} xë·Íé5×~Lsöù·Ã='f|·®§N ý¼W¼ùû3N~¸&äÑr²h §~¿/^¿;´áùý]xóëóç8ý?WYku S#=É P$ÑrÔ@ :Yzy5so-k7\{C§Lzä³=³,Ïi5ô&@)rÒ\µ´Í¢RÀN~[f®-× ×¯Öy{¦uön ¹4k+&*X¢( PH¢*ÍÚßZ¼Úé®<µwÃ{ÌwóÍç³3IÓ3I¬©¨£-ÉpѬµ%#K#[¸âÒo*-"®zS§¢òïè= !N¿2yÎ_OO?×C=@ATN¼MqçìPéÔïó|ù8ý RçÿÄ # P1! 02@B"ÿÚ ¯4ìò4ívM;piÆ)Æ)§ù¦ ?`;h ë8¡E±¦Ý~T' ! t )ò4(ÜþÏï´p\¸MâVåä ï AÐ9®î 6äÓµ;4Íø§ju8NÍ$-¼ìíQ ¸íÝbòA©Í^)ñ×ã²ÐÞ; ÿÄ & ! 0A#1"CaÿÚ ?ÚÉKdeeùY~÷ÔI(´bô_¡³S\{1ª] eé²üÌï¢ ×c{6j"ÛéºB÷ílÍmª#ºÞËô¹ör òDd) ['çe^Ù!d²Ê ù3¹ÆÌÙ£ ØóÔm5< )>ä-¬¿S50ÕDû~+¢ZyåÉrø#1K ¿Â;-ì¿;É#û¡! dül²Ëðd?·½¬²Ë,²Ë,²ÆÉg_£ä#~²ÄË,S²Ë,±ä§EY{I¥OÉ÷3ú6ùü{Y 6¬F#ìL²ÆÌÙd²¤EXÙÿÄ " @!01QABaÿÚ ?ê¤Pôà=8N#Óô(S¤|h¦(×Á(Ð-ä9 ç~ "â©t¾5>ºj%8-ÊÓ$CÑj'ë"jÅ+qÿÄ !P`p1 @QÑÿÚ ?êR*лBñ0E8íÌÊ&£ÿÄ $ ! 10@APQaqÁÑÿÚ ?!õÈZ?Oq99Ò! ¼\úE¢ G>F?BµBæÃaú$-#ôÈxücïVÕ^LÌKÈö>ímB?ÐÇésï|cÑí}äØY* ¡4 r2HM·GÓ@Ú,CX _dÝ¡§¿ôh¡4&ð+Xai¾F=ÓµBêá^<} 3Â~*àf¼®CéÎÉ Ú#£e0È Vu¦Z¡â3÷>¬&øMËTr3l$=_~µGØÉÈz½ ³ºZ£Ìz½ó·"d>¤'F¡6!#Xçá 22M ɺ¥ñ¶¤q~µ&ôBa¿àl£rÿ "þ¾aí£ÀÕh!4 $(kXM!ÿÚ ÷Äy}}÷ß_ëï¾ûï¾ Uè½÷ß}öÎÿ ûï¾IÀp2÷ß}÷ß}{o¾î@wß}÷ß}÷Û>H_5@C }÷ß}÷ß}ÏB²` ¶Ãß}÷ß}ñ.)ù bOnt`- @ G®lÝ~8q ´é¦' úðA.(°Â{ïcg 1Î8°Õ÷°Þ/v{æÚ¼Û}Hã¾à\wÇ à øuà ÿÄ ' !1AQ 0a±q¡ÁÑðñÿÚ ?º°Ä?P±EÄ MÇ4Áë8séweÈø~b#ºÑuìèY×CÉùÚM}¡H½A67øæY%AÄeí®%Îócyíd9ZdögsA¶ÊslA9¼¬¶Zq°³þËûìá<b`mlï¹S¯ïÑ>Æ >צÊ~ÿ Á.?¤ ±áäù8°x8ÜñãþÃhZëÂ}G{bÀqäçëli9u¦N}zùʺ.g¼¶»/ñ-§cÎ Â5ñ°°°°±øØÈ.N?d-;ÃcbGÁÓÑ(¸I*Éð¸q;,ö»¹ÿ |I K jvV%ÝYe-ÿÄ ! 01a@QÿÚ ?ã- ,÷,£ xOà [Ôõîx}ÄG¿ëÈ8 ÙwfyÏid ð<å§ ©$³óË,³ P×Rã &Ëñ ê<e¢ì»ÝÉìGöxyË<ò"jË3ÂxåYàE±s²Ë,²Ë,²È%úq¯ìIe2Ë,eYÀÃ'N2 äEu%A9,YÿÄ % !1 AQa0@q¡ðÁÑÿÚ ?è XæQä©_P2.9K%8KùjWÑ èÐYtª¯po8e/ç©_(W@ï °á±ØÕÆWxòÇNRþDøºþcV¬Ú2ÙuïÐF¥|bðs9KèlÞÉÍÝÇ z¾JzÂÞï{þæñã㬿Z¥9 Q"WôÙpn=ò/¡/ìÈ@¶3? Ð E¶ç(óOB_× òÞvË{uÝ Ùçòt¥Ä¯®nÈ[zÿ ÙÍÌ&G~¤õÎGxÓÞßòsÀ§ _u*T§ç Ry`§AÍÿ Äq+ ¯R¥J~ ½®,æT _¸GF bøq/Ò¢T©N$ SBFEÖËÔU¨ÍÁÍw7>Òlô\Z X£Ë(rmg(¸õH©Øò1Ö÷4$±¶*hâ-½wÜ8C«|héÐv+`vî_Ô©µÑDSzQ>Áç8#вûËðvæÚ4·eØSëqÇ·ñ-óÚ& ®hdç cËêAú\ íBÏháTnÚÊw4\¾|KûV8ؾaÕYÜ<¹N´¸øD¯¸N`źRébß·¬V,]\xÀÝô%|(ÓNêç²hT¿Qàºþç'3BWBWÇD£Ä£ÇÀåÉ»ªªwsû;°ó9ôý Éïaà²( X);䣨ó|¥e.(é©R¥R¥J*T©D£ À `d¸Åx"DÂWæRºp´§Ç]\´´§ÇP, ÀA¹{àææP&Ã!Ä;9¼î&b±D©D¨«fËþbf[ 1c (%Û}âTKÂØ d0 `ÜEm^¡¨EÖøº^»* îR"Kj£5¸ã)c )4âP7 ¥¥½qþ©²>¥JÒzAªîZ£ÍͽJ¡ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg&size=160 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/2.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 3324 |
| Response Body - size: 3,324 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ø#»)Ó\ùÎMI¸± ©b@ Õ¼äT½y÷éäã¼ó×#=ÒÉ`h X©`PP T× .5ß~.|ºc=ó5w¤Ô@ ©¨±A@Ø×¥¸YY½¹véäãã=àÏ\¬É P X©uW\åV㧣ÍׯÏÇ-ã ¼¬Çvum(ËRj ×.Zó×£^>YÇ«+3Ö,Y-EX éuzxòÑ%¶ó½¹uéãáÌz±ÌõËRo"tËRj "©dÐËQb±} xë·Íé5×~Lsöù·Ã='f|·®§N ý¼W¼ùû3N~¸&äÑr²h §~¿/^¿;´áùý]xóëóç8ý?WYku S#=É P$ÑrÔ@ :Yzy5so-k7\{C§Lzä³=³,Ïi5ô&@)rÒ\µ´Í¢RÀN~[f®-× ×¯Öy{¦uön ¹4k+&*X¢( PH¢*ÍÚßZ¼Úé®<µwÃ{ÌwóÍç³3IÓ3I¬©¨£-ÉpѬµ%#K#[¸âÒo*-"®zS§¢òïè= !N¿2yÎ_OO?×C=@ATN¼MqçìPéÔïó|ù8ý RçÿÄ # P1! 02@B"ÿÚ ¯4ìò4ívM;piÆ)Æ)§ù¦ ?`;h ë8¡E±¦Ý~T' ! t )ò4(ÜþÏï´p\¸MâVåä ï AÐ9®î 6äÓµ;4Íø§ju8NÍ$-¼ìíQ ¸íÝbòA©Í^)ñ×ã²ÐÞ; ÿÄ & ! 0A#1"CaÿÚ ?ÚÉKdeeùY~÷ÔI(´bô_¡³S\{1ª] eé²üÌï¢ ×c{6j"ÛéºB÷ílÍmª#ºÞËô¹ör òDd) ['çe^Ù!d²Ê ù3¹ÆÌÙ£ ØóÔm5< )>ä-¬¿S50ÕDû~+¢ZyåÉrø#1K ¿Â;-ì¿;É#û¡! dül²Ëðd?·½¬²Ë,²Ë,²ÆÉg_£ä#~²ÄË,S²Ë,±ä§EY{I¥OÉ÷3ú6ùü{Y 6¬F#ìL²ÆÌÙd²¤EXÙÿÄ " @!01QABaÿÚ ?ê¤Pôà=8N#Óô(S¤|h¦(×Á(Ð-ä9 ç~ "â©t¾5>ºj%8-ÊÓ$CÑj'ë"jÅ+qÿÄ !P`p1 @QÑÿÚ ?êR*лBñ0E8íÌÊ&£ÿÄ $ ! 10@APQaqÁÑÿÚ ?!õÈZ?Oq99Ò! ¼\úE¢ G>F?BµBæÃaú$-#ôÈxücïVÕ^LÌKÈö>ímB?ÐÇésï|cÑí}äØY* ¡4 r2HM·GÓ@Ú,CX _dÝ¡§¿ôh¡4&ð+Xai¾F=ÓµBêá^<} 3Â~*àf¼®CéÎÉ Ú#£e0È Vu¦Z¡â3÷>¬&øMËTr3l$=_~µGØÉÈz½ ³ºZ£Ìz½ó·"d>¤'F¡6!#Xçá 22M ɺ¥ñ¶¤q~µ&ôBa¿àl£rÿ "þ¾aí£ÀÕh!4 $(kXM!ÿÚ ÷Äy}}÷ß_ëï¾ûï¾ Uè½÷ß}öÎÿ ûï¾IÀp2÷ß}÷ß}{o¾î@wß}÷ß}÷Û>H_5@C }÷ß}÷ß}ÏB²` ¶Ãß}÷ß}ñ.)ù bOnt`- @ G®lÝ~8q ´é¦' úðA.(°Â{ïcg 1Î8°Õ÷°Þ/v{æÚ¼Û}Hã¾à\wÇ à øuà ÿÄ ' !1AQ 0a±q¡ÁÑðñÿÚ ?º°Ä?P±EÄ MÇ4Áë8séweÈø~b#ºÑuìèY×CÉùÚM}¡H½A67øæY%AÄeí®%Îócyíd9ZdögsA¶ÊslA9¼¬¶Zq°³þËûìá<b`mlï¹S¯ïÑ>Æ >צÊ~ÿ Á.?¤ ±áäù8°x8ÜñãþÃhZëÂ}G{bÀqäçëli9u¦N}zùʺ.g¼¶»/ñ-§cÎ Â5ñ°°°°±øØÈ.N?d-;ÃcbGÁÓÑ(¸I*Éð¸q;,ö»¹ÿ |I K jvV%ÝYe-ÿÄ ! 01a@QÿÚ ?ã- ,÷,£ xOà [Ôõîx}ÄG¿ëÈ8 ÙwfyÏid ð<å§ ©$³óË,³ P×Rã &Ëñ ê<e¢ì»ÝÉìGöxyË<ò"jË3ÂxåYàE±s²Ë,²Ë,²È%úq¯ìIe2Ë,eYÀÃ'N2 äEu%A9,YÿÄ % !1 AQa0@q¡ðÁÑÿÚ ?è XæQä©_P2.9K%8KùjWÑ èÐYtª¯po8e/ç©_(W@ï °á±ØÕÆWxòÇNRþDøºþcV¬Ú2ÙuïÐF¥|bðs9KèlÞÉÍÝÇ z¾JzÂÞï{þæñã㬿Z¥9 Q"WôÙpn=ò/¡/ìÈ@¶3? Ð E¶ç(óOB_× òÞvË{uÝ Ùçòt¥Ä¯®nÈ[zÿ ÙÍÌ&G~¤õÎGxÓÞßòsÀ§ _u*T§ç Ry`§AÍÿ Äq+ ¯R¥J~ ½®,æT _¸GF bøq/Ò¢T©N$ SBFEÖËÔU¨ÍÁÍw7>Òlô\Z X£Ë(rmg(¸õH©Øò1Ö÷4$±¶*hâ-½wÜ8C«|héÐv+`vî_Ô©µÑDSzQ>Áç8#вûËðvæÚ4·eØSëqÇ·ñ-óÚ& ®hdç cËêAú\ íBÏháTnÚÊw4\¾|KûV8ؾaÕYÜ<¹N´¸øD¯¸N`źRébß·¬V,]\xÀÝô%|(ÓNêç²hT¿Qàºþç'3BWBWÇD£Ä£ÇÀåÉ»ªªwsû;°ó9ôý Éïaà²( X);䣨ó|¥e.(é©R¥R¥J*T©D£ À `d¸Åx"DÂWæRºp´§Ç]\´´§ÇP, ÀA¹{àææP&Ã!Ä;9¼î&b±D©D¨«fËþbf[ 1c (%Û}âTKÂØ d0 `ÜEm^¡¨EÖøº^»* îR"Kj£5¸ã)c )4âP7 ¥¥½qþ©²>¥JÒzAªîZ£ÍͽJ¡ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 9692 |
| Response Body - size: 9,692 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ôímm°Æa:YÆã[jP<½ TÄd MS$ 9=Ï;èîè°[Åvî}[çþ¡XgêñºUûy;¡ ±V jÀÏz!èúnk£KÇ?râv96ÕÓy^Uãϵ§³ÒN·3uÈíåÁ±å)ÈÃ-ìß0ôöÚ>¾)Ò+hÃÖÀ Á |££ ¿-ô¯È·ê¶~Ìåu´v°Fî¥å^¾ÞÔ:Ójr·ÕDùn_Íú>}G÷Uºìþ«³©ïÒaÍClz"ES F`>X´÷|"Ñú´Ç=ßIâ³k{}b¶y,8ó× {ñz¼»ZöK.«+>½^{½£º¶ÀDT£(LUhËenóV&¥â'sG±ñí|þ?8ôÔ=-.¿·8Rê®q1å= gè q2ñ:þѪ±5 ËÇwÉ &¶2DÄÆ(º'kÖxêl}ÞË ÏgÎú½<éñó÷7Ä=§%/¯ÅÅ¿ö/ûvssöõZ¸zH |¼w| M¦<£Ó³ôÏ}:w -6xígÌçÁ©µ]óôΦ£ïñô(¬ëzÞ·r+jáê |¼w| Qj¦ÍXËÓ>mÑÒ÷úf çæ.4¶nÉ>wo õLeYiDÛ §+[±]»cËÏ\Ôy{ Ë×w|XU"@ dF½vð'ÔzýÓ¡IäTØÎj_¬ç 1åÇ*jí5ö:õ¶9Ô >àó!Þr $ÅТⶪ¾+V&½^^<3úN_5ë9®6|Y::B+d¥k+n föÜ åÚ¶¬d 2 ç" ¤ÄJÕêü¬xúýÚÑF+ KÆ>§¶·fc¼áî¡ÈAÞr0 T+cÒ>MC?>öáÈÜãÆz¹]3&×6|½nÙy ©±ÿÄ ' !@ 01P"#3ÿÚ þBl)ÿ VX&{¿Á%ãâå× r0« 8ѹg6FØ´=þO?¼èï(ðr Ç!§ÌN?ëS9nB i3ýébgÖ·`áãc[˶ùÙWFÒ²°Ö°/×mÄ éïQÃÕÊ¢a ñÞÚYS«¯)Èsâü a²U^<iîm ©Í>ìé2¦ «#kc ¥|Ì© ÿ y¯x¦ 1¹§Õì%ÖÔ×Ô6ú¼g-V'U G¦Ét2Q2Í:Sêý Ï9w÷ÔNq#ÙYTá1êÄaî°dlº8˯h ¦Ns űîÄq=l JuR©{g*:U¬V´» à"7þB";Ê×®~¼b§5N®«¨åÇE QÄá9Y<3×?^3ã+Ze|UÐÄ¢]ÅMB;JB ñ&+¯vVV<f##z]W}Æ@®G$rk¬È1P9ÉF2&_çtQªKmO²ëIöe¨0½ ÅÇ §ïkO±Ç ˶Î÷p$HCÚ9¡BÔ¥õ ´Þý±I°êõ^2Ø; ÑÙÚÔHôÄ3 ¿<[g 48ÃL4Ö¥ç<ûAÓí É.2eÓ"q'¦>IyÎïBë¡6ßò£!/g¨?ãXK»¦.>dëø: jáÐ=3ã4«g£iÎ+y1êqÚad¯ËÇã$0âäVʯî¨F¡h ð#~7TÚUuöÕì 'Ôö2©ëCaÜü©ÈðÔ=³±£ÜáÇñö-Êbë{£QÔ:ÚÅý9Ï')$Lÿ N±òc/8NsIü\z'ðR» ø2^¿FH#)È]cëõçËgÊåÜêßÿÄ ' !01 "2A#QBÿÚ ?k¹ (gÉCüzGs BAÈÿ pð³¾PÊdlÕ¾V4ûpM«ëjûxþÓÊlí®h%¡Ç¦!©}pÉZíÊtÚ·dÜ×LuúPêLË×Ê2Ç;tþ©qÝXæ¡oÙ\RÍpÂVFv«MÈtÏåÔ£uèqM?j7¸ ýû_èpzâ|o¨ôZµ~L°ð£ÎÊÌP$oY ¢6ò Él_v<±<5Ü· ßzl;üÇi Ë í¨&e´»í1Û6Ðîô(æ hÈ)eL5Uù ¢ô8qwPÉ«k^ +2]¨èÙ^ßF%Õ%¶{ ¬<ù*YÆlòë¹u0¨¯Q}æXúÉ8jk®$[AôRÍ ÖØϤ0 0ÁC ï°Òp£J6ÁÀ(ïòk0hXs¾GºÿÄ - !10Aa"#2@Qq¡±ðñÿÚ ?e(pÞ [>Ë ¦¯êû +HFcr(åõ% ±´]ivØ~&³Lkl ÀýýøÐ03ë8Qâ¢fqL L{*u«y] Kqø]iNÞ±Þ[ qÊÒÞõ4÷iªGi§Õ×püÄGÈ1Û;xpå&ål¼r I^½8ÁóJ)î&¢õXéÊpÂf°;NfsÞÌ]æ¼bÜg>}Úd¼|b]ÂÙOÂv>Å¥/Þ2ç6¾e:[/Ý&<ûôU]¹ï*êWð¾þó[ÂÞuywM °´Ø¡Ð @ì72î ÕGlG^V+çqAóc!z ó:JàúM~µ%Saaçktýd÷jÎ!¸ ÛiºkÔnæ¬úĴ驦þ%C½¼î%¤ÇÌYM-kòA² <ÍoIPFÒÜ<½¼ç@ãjÃÕycü@Üà4ågÔ ¿×ï×ì/¡n\4Ò;)4[Ü ^©tëï.´ÚÜÇìm@Ãõ+nd e5ÏRØûËXtà¿öp¥¯Ó%5©_ÿÄ 7 !1A "2@QaBPq¡#R03brÁÑð±áÿÚ ?ò°¹@þ%´PQúäHuÓ/1K¹:e¡IТ¥A¤zAZÙ(÷&áPðöò Î(xF¾[^ÆZâRJÀ(Ú°ÁE=ý`KJ08Á74|<íS< ji ]HQé Öð¶_= !Sj,á4à=t®K+ýßÇIûÃ%¶\¹)IÉI ÌKSu{»E& 3dðÊUG«BÀg}½¸Ü4çë¡u$ ¾ 4Âì-o8Æáb¢Ú,ºé½G÷1@Ë·.[zYÅ LÏ£Lµ s®MÛaXXF+>NAV³ÚñòÐ¥zF$LS1` ÓfIÎU«½ÿ ó,£pØÁ×åw1Z5ߤ @¬b ³ËDáá·á¶8h3r`÷¾Ä"YÌáW1+ôSóIùÝÂøBj÷±¼]Èg¤GÄk+·Aí8c0º¾o«ó5£?Ö ©ÿ ·Ù3$U{_.Üêf¦ívxJÒx²ïÒ bÀ[ÚÝZ)H`,Ê&¤üáÄ}ÿ ç=\µR®°Ó/¶ h©hÆ@dʦ.PDÁ¸àñ¾Amäô9zB¬¡`ï$^±-U?wÇ( H§ðì.®ÏÚàÂ/ P ºÃ %Ûêç¬îRp ,íï4eÛMV$ÁÔÒ¦U%ËB åhrÄRÊõkh©xEqø¡:ºÕf=K8¦) ßËYo¤áE=úÊ>Vó i¾lç KB źèJÓKÀ[ÜdѾïùÄë%#©û ³ UcÛ- ¾' 9g¹0Jæ2çv ±ÐTCþX/kµô6pªC¨u´o¾zt TÆ÷ÄnþV 44¸ÇEpXà}^Þº³Ä#äIñ0ºÚ \G /-5tÉ¡(\}æp¥)ag·¡ ØQá6TWR0}Õ8Ifký;TÌp|%ðÓ2ei6-CÕ( Ä»õÒV²ÉÀ©zÆñ¶;iJ娽Êý¡+ÂyÄ8¤¼¬i7Ä! EH^0ÉÀa¶ Þ¬ &â)w ÌÜé¿»W´Tà¤àÝ"Cârïö Ïáÿ ánüy¥¯¸h|ãr<4m)),ªmLåT±wòKĬò¥9¶Ë$zGŪ\ÊZ¾¾E©\g<MýS{un@ IÂÖ V ñþIªÀøWüà bðuööýàXR* `3©R4'P PÖSr=`TèúÄE|$_ "XJ %gLCätÿ ÿÄ * !1AQaq ¡ð0@±ÁÑñáPÿÚ ?!ÿ ȲM°Ú?§¤Ç¶/θ9h¶>Fx?AûEF[³À´!uö¦º]y¢ Ò¬"»w' ç:ûhÞ,Y:«·2°7O¹}h&ÿ ÃCkzl´æ Iÿ ?åMº zÉ [XóPRË"àÙú8$sr?Ö&Yj ñ¼y¿-Og°÷úqö/näÓ Ùà M±¿XqcuÃÇo4qE)ο¾áK\Û Ýß ÄÖØ>Z6ÖÞÜ pT :üBC\~êÚõyRq~«êM@ÞòB=êä,ÜYKãõPL8X÷mV Av¦úi§½¾ÖÁ2Î DI{ÌAóY"*b]'{eÿ "Yr ÛþkVªtÍ*ÁN-ùßJ´[Íã=·èÖÏØ~iß ÕÈò>;ÐáÂmÆ>ê3MÌ Nç:. ÈÔåÞÄ»TÈ%Ç ÂEC3¬_ü]Ù24Ò©CAxÕüµ5³u¶úR¥¡¨,!# ©zµb&!³þ&HXö©©B- ÆþjrªÊ¯éY±Q"`þ=õÅwôÇÑ}IÀU9p¬É¥E¥0/ÄüjB&¢a¸Àérü¹.áÍ°üÖX|¸T;°²Bû Y|ÓIAVðM IfRI:SÖ¶ÿ å¾Öí9æïZH&É4n»3hY³Ö-ü«Ul¬½_Sõ¡¨©ZàôY eèvµYÿ fÑ=cZ)qÖ-Xæ à üÊã&1:ÁóÓ1Mùµ-iD,Ééæ!ÎÉ ?!Þ ÄeMv ²ÿ _PàÒknäÔ/bÇàßO[ê~¥x8§(TdÊkT°OÙiéza©$Æ ¨3I·Ë°DÔ@o§ZöóµAS)¦£tÜg\9z߬zÉÀmB 9ÚݶÜ;³ ûéÂbÐ X7i} [Cn À\lE´êàúZ© ²Tz¬ÄÎMÝiü-6 :[°Ò¹µ ÝMÇ;þ6©¥à' bwÍ[0"»N sÉPL2cÎÝ/H0r §ìÃUÍ!Å Ã.þCNõ ܽî\ø ¨²«2^"ßÚnQy¾ÿ h·Ìºm?5¢<êì&ëbþ* ¸c©:ö÷8Xê '\ö§BªH°ÎfúíÞxY ¾:PTȾësοc ÐÅ/öÙ!3Ïfëy.\bôI"Á²IhZÐPZÙ>Ô¦¦¢ÉD^ÌUò7T,µÔítcöÑ!M`h.ÌëW %¹-ÙØñ§ÚM/¡¦"º? +Ú 4ÒQÁuªZÃÙ e°NóScÄNnøö¦ª#ªü_¶ÂL Ìäuµ]þÓ¥ÁÀ?{Õà%a,G\Ò )SPÆ Â& ñFAÙPÿ æ®FíÏÈþ¢¦`p;´ð] Õ «Ö;ºV .rE¾c½?nði(FåHFbD´Oáòx¢~nù«X/7Ìéý£ ,F(ð[M"ân#¶"iL (9\E-ÖY ¥8NLoXNµ]ba îå(L.¼jÈFFF¸h´¶$gÛóL-±/ Jê@vΤ#P84м"ÎN¦ÒG=ìäìÊ`ó¿Ý4HH® ëxÚ*d]êhõÞª¡"ÄB©ª8<¥»â˧*ÄAcn\ £G}©¨Ê è;U¬´Ãûk5[5sÞÎ,iÏ¥- A²ÒC× ÑëF<Ë{ßìb£Ð W D4¬e¿·Ía ¹gkͪ-¨Ã{Å( c5Z@^&kàÉï7ÓNýêjº_ú5Âë-C{ÅP0"¦¦z éRwÒ¡BûÓ÷Ø\d°¦æ,ò[Í,i ËØù¥M4¼ønÒZN^V|·Þ/¥¹DÎ0ÏVhdØ¥ÀsB:×`ø|1O¦=HûRðq iÙÎö Û¥%TÖ®Zm ý *¶ m&°ÒÀD°ßÅ 5A n£öÒ±4n¤×Íê* rhCu ÒÌR¹aëÂ+ÿÚ Ûÿ ¼, ¬0à 0Òÿ ï¾ñ *¸ËJP 0ÃCo¾±³.åq (0Ãﾯ4}qÿ 2fs à ÿ ¾kcÌG:Á0 `ÃCh7À/Áóðý?« ê 0à <Èlðñ©+!0à 0¯^(XT0à ¬²¤gÜÈ`°Ã<2Ë( ®J Ã÷ß}óàÎõíú@| PÃ÷ß}÷ß}å0ñÑWÞ,Ãß}÷ß}ø ='qßÿÄ ( !1 AQaqð0¡ÁѱáñÿÚ ?ËЫp%{5ëÎgÔàPv :,ó\`¾ªr i=!hµ¼ !×ø¸ æÖ xí/·mB («2:cçisL¿3ÈõýE+Þ*Ò7ómÌãQDK:ð af$fT/5.Ê$oA¨7ÀªËn ÊfÛxQûR¨ 9ãÍåÚVñôÛúñª§Q¦SI+¡´ eƪä=öþý¥4;»:hå¸Ã©-C0¾1©qeÁѳ¤oÛ~ò>Ii[éÊmÚøå2·'ízJªÕÅF´4´z¸ÁÉIÊ/4ÏT?m~Ý"Al?Lev².¾» !ò£L T²[ç?+í <.\¾Ð«ã]ü³8|ª^º0&^ÿ .5Vmô.\½îÇ·£*@y=b£å.\| Ù °QõfRwÏ(a&GôÎUÉÞ L¨FpBñxöô,Âþ¡ ÿÄ ( !1AQaqð 0¡±ÁÑáñÿÚ ?HìÛÑØ'Ï9Ó bI9>×ä+ GåûzUÕ®èÉïÛ44½Æ|Û÷HÜ®«Æ±Þm1 Îc½õ¨õY DÉÄúÞôs¥RHzÜ¿ÚRÚL~£4ÈeßmèÙ3)Y´m1®¿ÖËÑ''³ôð£bãGoMG¹õ~4Û¿?u¬N'ã~ÉBGònR1ðü Z y¢EµÞÃõ¥FM¬ <ñÚ:Òå'¤üÇ2oÒÄ =( áɪ'pq¡ ¦-}u}Öûäz W©kÙbúðu#ÕöEEG¶*9Ô×þPü/6ͬ»EÂM&l§uÃRf¼(Îqåûi9 ÞY¨¨ùP7g~1D=ê~Éhl"¿#Ìp©2à×[*CÙLÿ jjW/§ÖëW;`¦¿#I´OÝë(¹CZ êúÕäh ±mï ©jGKÌÛj Eéù À²å+ >lÑÈA¼Ü¿à <ÔØ«®ø{ÐùIiI|3vì±bfVq>Ȩ÷Å%'íqrò±]L6Îu£ cÑnÕ-IWO[$ßrÖÿ (æLxãâd Â<ãÒvÊÀ·>of %¨êFÈ® Q÷M?2b¼0í:ÒE7Æðè»ürh)C7àówÚôx1:çÑùçmÈùé³D åH)Zx <µ Ù³ÀçªÀ~èå¾4¾²ÛüG§ÿÄ ' !1AQa 0@q¡ðñ±ÁÿÚ ?ú##öR?}>ÎáH"§"(rÙôÎAPBº©%Õ:! .ÆXè O²üûy4°^ãVÑq6æÃ˼¡áQKËSL+Í7(#á4qIS9EDO4âàáÐ b J Ü"¤ÊVÜÉ) Ø$®«ä×cS¡4N>· |}g;½qþ?¥?§ *ºåÊ6NR»pô/ ]ûÍÈÁCmA/~ fÇ7e$ ÈÏ/þãÅZUøpqªE[tpÐo4 =M;à þ^tgL$lX2ŧ!¾'Ó |>óõ;MÀ Èéý8F õÈ ¢VÒ#²âR] ® ZM(D0IÂé®ÍWJ ºa9ÆÝ[ ß³÷ )ê×f×ÖÜAM¢QÉJL6þJ W[¥÷ã ª° ;¨x¿8Ô¼IÂ®Í ·Þ §Ï'ðÁr¥ a:B<aÙ¼J®ÄÆðo¥Ñ RìxÞ X.ªÀyÕthØA,b·ç½¡o%vÐçÞràl¨AE-Þ¡ ªXá.V2% ®5#B5wJPE&¯\]ÿ ³ vKÛa)èÁl±®ÑPÎhÔ)ĤvBÓPOaA 6->",<$¯muURÝ×/ cípú¤LªÙm#D4 SÂ\]åÀp vÁr Q<,²qî×P4t` Ö8{ÈÜJ 7=*q.y] Õ¥Á,*<Dlê®C ²ý#Òfáø x%X¹ UB¸ v¡§ 4 §[ mME}Ã@1`X¯Ó«ª¤¢aÔkBOIçékÀ;Ï/y¾#®MdLQ6©tè'¥*TM@T ÐóñàQPÿ "m%zað:äì)J"`ÌD¤[KÀÍó/Ùä ¥WÚ×[%¬ À ÄRPR] ÐÎH.ü«UÁ bB»?Ø9&(OôÊòÀ߬¢i0Oé?y#ÁD! NÊÆ 1WGaÖ´¤wõº>¿V x2PÁ`q(b2> Ù½ kn]¨]¥ð"Ñ6ó (lHë 0 ÊÂoCË9Ü#VemÕ:0È m©IÏ5ÎÏ8é ¼h¾EðvZ r:¢BuNëA*«ÏUÐh4 l ÐFÖ9K0ð`×¼%zò<â@lPi7ÍtUO¨Gí'Ð.(Ê0ïã9²×8 TNÔ®41¥ 2a¶ù ¯°Óes¢ãG)ú_8ïÐ, W¸¾}mªtUVrÕk vMR*©ýÎ#BÔµ-[ ræró¡ u¸ò!R Z8NQ1×ÓÃêwÉô'ßÏO¢cN1¬,&W>þòb¶Pt&ÂDR, UPÄO#LG¬Ô:T¯u5åBôAÍ@¼ç.ûÏ'õg¿ÈäÕ@¼é Ê|ðÊÉ>ØÖùéòïôaóÿ a£DÝ×cËG] R'j)qÇÄ ½ I5C9ÚÅUÂ5ÄÐ4Ö%&H÷»ý¸ âOh*I¥t85£ ü wÊ@þr{Ù8À=è Â}«&é O±ôïâdr|ýä¦"|ñÈᨦLð`¨ÊvòhÍ#Ç ahL#§ TIÁBÄMËw¡ (Q#¤÷&ªüngcÒu ©¢åÂTxÉ¡²! V(BDËÅ;B t à?ÇiÞªÔ<ñüq]8êØô¢" É®°¹y] ©Çº©ÎbÐEjJjk:ÿ (t¨ ¸éjâ© Ñbi·Û uT=¡[? >ôxÈññÁÃ)·â 1C5Ø?¼51Ø_`»#¶%p4Þê X0JlÀà)Å ÕònÌÿ §QAS¦#¥ ºßÀÇÁQ¡}¢láåÒ%¡¤ hyZDØ¥§"*bô¤vPv>cõ÷(Òx}8FNE!A+¹¤)Ò`^È :%=+>]?k¼§ëåk ¼@pêÀ <ÍÆúqv0àÆ{OxgÃUI«Fj^MFËçxô=fè$SnÍä¬ ¦L-¨ZT §mþÐÎaö©>9~9Ç9¸Êx¢A9PCXrÜѤt×þwÆNÇBÎ`¨ 4 nRAm °¤ w®i<9NBV Óã Ð0ËAîÔy´äf¨XÚoMt Ñ2coXïj!лúÄÚÐGJoO^sKo ¢y)o`ÜA+?Çû¼H#`M¶¼3 töu_ÅĤÁÓXZ°¨Î öÛX9 UBóÜTåRDbuÎq·©¯¤©A±ðÐËcGcS¼4º+ûf$÷ ®¿£x1$£Dp ñ0^ð)cQDP 5f¬ÀÁD ;VåÒUú¬$ ,:M_È`;ÑM ëYKF IúDé(5ø©LDÄ sÁ³?ÕË!ÓÙ#Vuµ½,ÙhåÅ¿ °K¹)ØE#ë'Ïõðõ2Ï ±U"©JÚÀÙu¢! ¼t/EÝi3iªnn³ZZ¯ãCÆmÀçû9?¬@÷ÒV¤ È8& B?ÈìÏÓ ³t§¯jÀ ªñI%ÙF jËw/yÂ1# 80_ßÀ Ý4[¬T<"FÄjEcªK:ò ÄûXx2<êÉ÷¶/9>°¬0n/y¥×Y¶cÁ.kXÄcÃëieh4¥£Ï(QD§Oã4¡AÇ-¦# 8ú p ¤Å b× ]Îl±RoæL?!ÃØëIù3jqPíZ ExÇf"}ô=cââ''Ê>Câ XBZçLAç r[¯®ÓA7äÙ0Ïxà&Ü&ãA/J§°¦}0 ¥ bi=9¹~³õŤγª[bA!+|* _áCÁð}KadjÆ:ªBóE ¹Ð°¾ ëÛåÁdNZP $IYU<à âúÖyøåügÕÊ"Êù1AÜiRJ¶ õÞrùy aqk~ j x ba¼øá]ÑÙ êJDv&ÎZ:ÓlLSúÅÛú1ÀôX@Yí×)ÎQ¤«È4ðc¼yùyüeò¯¦Ø ÅÞ¢ª J¥b«ÍJ$ÙÕ4£kÁOë Qra*h*(râÙ4H ãA/I]ñ¶þ ~Uq'Ðø8£ðgÐë)ÇÃ5A¨Ñ =T8m6ÆÃÌ]8WMC òæS§t¢£Ñ*c²¤ð ªð ¥y°:ÁÚ}a$p Öáö|c !òZÒ S@ÊÁwà héCNßlÞ¾ "@w»»3içR`£ëÈxÇÃ?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg&size=160 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/3.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 393 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 9692 |
| Response Body - size: 9,692 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ôímm°Æa:YÆã[jP<½ TÄd MS$ 9=Ï;èîè°[Åvî}[çþ¡XgêñºUûy;¡ ±V jÀÏz!èúnk£KÇ?râv96ÕÓy^Uãϵ§³ÒN·3uÈíåÁ±å)ÈÃ-ìß0ôöÚ>¾)Ò+hÃÖÀ Á |££ ¿-ô¯È·ê¶~Ìåu´v°Fî¥å^¾ÞÔ:Ójr·ÕDùn_Íú>}G÷Uºìþ«³©ïÒaÍClz"ES F`>X´÷|"Ñú´Ç=ßIâ³k{}b¶y,8ó× {ñz¼»ZöK.«+>½^{½£º¶ÀDT£(LUhËenóV&¥â'sG±ñí|þ?8ôÔ=-.¿·8Rê®q1å= gè q2ñ:þѪ±5 ËÇwÉ &¶2DÄÆ(º'kÖxêl}ÞË ÏgÎú½<éñó÷7Ä=§%/¯ÅÅ¿ö/ûvssöõZ¸zH |¼w| M¦<£Ó³ôÏ}:w -6xígÌçÁ©µ]óôΦ£ïñô(¬ëzÞ·r+jáê |¼w| Qj¦ÍXËÓ>mÑÒ÷úf çæ.4¶nÉ>wo õLeYiDÛ §+[±]»cËÏ\Ôy{ Ë×w|XU"@ dF½vð'ÔzýÓ¡IäTØÎj_¬ç 1åÇ*jí5ö:õ¶9Ô >àó!Þr $ÅТⶪ¾+V&½^^<3úN_5ë9®6|Y::B+d¥k+n föÜ åÚ¶¬d 2 ç" ¤ÄJÕêü¬xúýÚÑF+ KÆ>§¶·fc¼áî¡ÈAÞr0 T+cÒ>MC?>öáÈÜãÆz¹]3&×6|½nÙy ©±ÿÄ ' !@ 01P"#3ÿÚ þBl)ÿ VX&{¿Á%ãâå× r0« 8ѹg6FØ´=þO?¼èï(ðr Ç!§ÌN?ëS9nB i3ýébgÖ·`áãc[˶ùÙWFÒ²°Ö°/×mÄ éïQÃÕÊ¢a ñÞÚYS«¯)Èsâü a²U^<iîm ©Í>ìé2¦ «#kc ¥|Ì© ÿ y¯x¦ 1¹§Õì%ÖÔ×Ô6ú¼g-V'U G¦Ét2Q2Í:Sêý Ï9w÷ÔNq#ÙYTá1êÄaî°dlº8˯h ¦Ns űîÄq=l JuR©{g*:U¬V´» à"7þB";Ê×®~¼b§5N®«¨åÇE QÄá9Y<3×?^3ã+Ze|UÐÄ¢]ÅMB;JB ñ&+¯vVV<f##z]W}Æ@®G$rk¬È1P9ÉF2&_çtQªKmO²ëIöe¨0½ ÅÇ §ïkO±Ç ˶Î÷p$HCÚ9¡BÔ¥õ ´Þý±I°êõ^2Ø; ÑÙÚÔHôÄ3 ¿<[g 48ÃL4Ö¥ç<ûAÓí É.2eÓ"q'¦>IyÎïBë¡6ßò£!/g¨?ãXK»¦.>dëø: jáÐ=3ã4«g£iÎ+y1êqÚad¯ËÇã$0âäVʯî¨F¡h ð#~7TÚUuöÕì 'Ôö2©ëCaÜü©ÈðÔ=³±£ÜáÇñö-Êbë{£QÔ:ÚÅý9Ï')$Lÿ N±òc/8NsIü\z'ðR» ø2^¿FH#)È]cëõçËgÊåÜêßÿÄ ' !01 "2A#QBÿÚ ?k¹ (gÉCüzGs BAÈÿ pð³¾PÊdlÕ¾V4ûpM«ëjûxþÓÊlí®h%¡Ç¦!©}pÉZíÊtÚ·dÜ×LuúPêLË×Ê2Ç;tþ©qÝXæ¡oÙ\RÍpÂVFv«MÈtÏåÔ£uèqM?j7¸ ýû_èpzâ|o¨ôZµ~L°ð£ÎÊÌP$oY ¢6ò Él_v<±<5Ü· ßzl;üÇi Ë í¨&e´»í1Û6Ðîô(æ hÈ)eL5Uù ¢ô8qwPÉ«k^ +2]¨èÙ^ßF%Õ%¶{ ¬<ù*YÆlòë¹u0¨¯Q}æXúÉ8jk®$[AôRÍ ÖØϤ0 0ÁC ï°Òp£J6ÁÀ(ïòk0hXs¾GºÿÄ - !10Aa"#2@Qq¡±ðñÿÚ ?e(pÞ [>Ë ¦¯êû +HFcr(åõ% ±´]ivØ~&³Lkl ÀýýøÐ03ë8Qâ¢fqL L{*u«y] Kqø]iNÞ±Þ[ qÊÒÞõ4÷iªGi§Õ×püÄGÈ1Û;xpå&ål¼r I^½8ÁóJ)î&¢õXéÊpÂf°;NfsÞÌ]æ¼bÜg>}Úd¼|b]ÂÙOÂv>Å¥/Þ2ç6¾e:[/Ý&<ûôU]¹ï*êWð¾þó[ÂÞuywM °´Ø¡Ð @ì72î ÕGlG^V+çqAóc!z ó:JàúM~µ%Saaçktýd÷jÎ!¸ ÛiºkÔnæ¬úĴ驦þ%C½¼î%¤ÇÌYM-kòA² <ÍoIPFÒÜ<½¼ç@ãjÃÕycü@Üà4ågÔ ¿×ï×ì/¡n\4Ò;)4[Ü ^©tëï.´ÚÜÇìm@Ãõ+nd e5ÏRØûËXtà¿öp¥¯Ó%5©_ÿÄ 7 !1A "2@QaBPq¡#R03brÁÑð±áÿÚ ?ò°¹@þ%´PQúäHuÓ/1K¹:e¡IТ¥A¤zAZÙ(÷&áPðöò Î(xF¾[^ÆZâRJÀ(Ú°ÁE=ý`KJ08Á74|<íS< ji ]HQé Öð¶_= !Sj,á4à=t®K+ýßÇIûÃ%¶\¹)IÉI ÌKSu{»E& 3dðÊUG«BÀg}½¸Ü4çë¡u$ ¾ 4Âì-o8Æáb¢Ú,ºé½G÷1@Ë·.[zYÅ LÏ£Lµ s®MÛaXXF+>NAV³ÚñòÐ¥zF$LS1` ÓfIÎU«½ÿ ó,£pØÁ×åw1Z5ߤ @¬b ³ËDáá·á¶8h3r`÷¾Ä"YÌáW1+ôSóIùÝÂøBj÷±¼]Èg¤GÄk+·Aí8c0º¾o«ó5£?Ö ©ÿ ·Ù3$U{_.Üêf¦ívxJÒx²ïÒ bÀ[ÚÝZ)H`,Ê&¤üáÄ}ÿ ç=\µR®°Ó/¶ h©hÆ@dʦ.PDÁ¸àñ¾Amäô9zB¬¡`ï$^±-U?wÇ( H§ðì.®ÏÚàÂ/ P ºÃ %Ûêç¬îRp ,íï4eÛMV$ÁÔÒ¦U%ËB åhrÄRÊõkh©xEqø¡:ºÕf=K8¦) ßËYo¤áE=úÊ>Vó i¾lç KB źèJÓKÀ[ÜdѾïùÄë%#©û ³ UcÛ- ¾' 9g¹0Jæ2çv ±ÐTCþX/kµô6pªC¨u´o¾zt TÆ÷ÄnþV 44¸ÇEpXà}^Þº³Ä#äIñ0ºÚ \G /-5tÉ¡(\}æp¥)ag·¡ ØQá6TWR0}Õ8Ifký;TÌp|%ðÓ2ei6-CÕ( Ä»õÒV²ÉÀ©zÆñ¶;iJ娽Êý¡+ÂyÄ8¤¼¬i7Ä! EH^0ÉÀa¶ Þ¬ &â)w ÌÜé¿»W´Tà¤àÝ"Cârïö Ïáÿ ánüy¥¯¸h|ãr<4m)),ªmLåT±wòKĬò¥9¶Ë$zGŪ\ÊZ¾¾E©\g<MýS{un@ IÂÖ V ñþIªÀøWüà bðuööýàXR* `3©R4'P PÖSr=`TèúÄE|$_ "XJ %gLCätÿ ÿÄ * !1AQaq ¡ð0@±ÁÑñáPÿÚ ?!ÿ ȲM°Ú?§¤Ç¶/θ9h¶>Fx?AûEF[³À´!uö¦º]y¢ Ò¬"»w' ç:ûhÞ,Y:«·2°7O¹}h&ÿ ÃCkzl´æ Iÿ ?åMº zÉ [XóPRË"àÙú8$sr?Ö&Yj ñ¼y¿-Og°÷úqö/näÓ Ùà M±¿XqcuÃÇo4qE)ο¾áK\Û Ýß ÄÖØ>Z6ÖÞÜ pT :üBC\~êÚõyRq~«êM@ÞòB=êä,ÜYKãõPL8X÷mV Av¦úi§½¾ÖÁ2Î DI{ÌAóY"*b]'{eÿ "Yr ÛþkVªtÍ*ÁN-ùßJ´[Íã=·èÖÏØ~iß ÕÈò>;ÐáÂmÆ>ê3MÌ Nç:. ÈÔåÞÄ»TÈ%Ç ÂEC3¬_ü]Ù24Ò©CAxÕüµ5³u¶úR¥¡¨,!# ©zµb&!³þ&HXö©©B- ÆþjrªÊ¯éY±Q"`þ=õÅwôÇÑ}IÀU9p¬É¥E¥0/ÄüjB&¢a¸Àérü¹.áÍ°üÖX|¸T;°²Bû Y|ÓIAVðM IfRI:SÖ¶ÿ å¾Öí9æïZH&É4n»3hY³Ö-ü«Ul¬½_Sõ¡¨©ZàôY eèvµYÿ fÑ=cZ)qÖ-Xæ à üÊã&1:ÁóÓ1Mùµ-iD,Ééæ!ÎÉ ?!Þ ÄeMv ²ÿ _PàÒknäÔ/bÇàßO[ê~¥x8§(TdÊkT°OÙiéza©$Æ ¨3I·Ë°DÔ@o§ZöóµAS)¦£tÜg\9z߬zÉÀmB 9ÚݶÜ;³ ûéÂbÐ X7i} [Cn À\lE´êàúZ© ²Tz¬ÄÎMÝiü-6 :[°Ò¹µ ÝMÇ;þ6©¥à' bwÍ[0"»N sÉPL2cÎÝ/H0r §ìÃUÍ!Å Ã.þCNõ ܽî\ø ¨²«2^"ßÚnQy¾ÿ h·Ìºm?5¢<êì&ëbþ* ¸c©:ö÷8Xê '\ö§BªH°ÎfúíÞxY ¾:PTȾësοc ÐÅ/öÙ!3Ïfëy.\bôI"Á²IhZÐPZÙ>Ô¦¦¢ÉD^ÌUò7T,µÔítcöÑ!M`h.ÌëW %¹-ÙØñ§ÚM/¡¦"º? +Ú 4ÒQÁuªZÃÙ e°NóScÄNnøö¦ª#ªü_¶ÂL Ìäuµ]þÓ¥ÁÀ?{Õà%a,G\Ò )SPÆ Â& ñFAÙPÿ æ®FíÏÈþ¢¦`p;´ð] Õ «Ö;ºV .rE¾c½?nði(FåHFbD´Oáòx¢~nù«X/7Ìéý£ ,F(ð[M"ân#¶"iL (9\E-ÖY ¥8NLoXNµ]ba îå(L.¼jÈFFF¸h´¶$gÛóL-±/ Jê@vΤ#P84м"ÎN¦ÒG=ìäìÊ`ó¿Ý4HH® ëxÚ*d]êhõÞª¡"ÄB©ª8<¥»â˧*ÄAcn\ £G}©¨Ê è;U¬´Ãûk5[5sÞÎ,iÏ¥- A²ÒC× ÑëF<Ë{ßìb£Ð W D4¬e¿·Ía ¹gkͪ-¨Ã{Å( c5Z@^&kàÉï7ÓNýêjº_ú5Âë-C{ÅP0"¦¦z éRwÒ¡BûÓ÷Ø\d°¦æ,ò[Í,i ËØù¥M4¼ønÒZN^V|·Þ/¥¹DÎ0ÏVhdØ¥ÀsB:×`ø|1O¦=HûRðq iÙÎö Û¥%TÖ®Zm ý *¶ m&°ÒÀD°ßÅ 5A n£öÒ±4n¤×Íê* rhCu ÒÌR¹aëÂ+ÿÚ Ûÿ ¼, ¬0à 0Òÿ ï¾ñ *¸ËJP 0ÃCo¾±³.åq (0Ãﾯ4}qÿ 2fs à ÿ ¾kcÌG:Á0 `ÃCh7À/Áóðý?« ê 0à <Èlðñ©+!0à 0¯^(XT0à ¬²¤gÜÈ`°Ã<2Ë( ®J Ã÷ß}óàÎõíú@| PÃ÷ß}÷ß}å0ñÑWÞ,Ãß}÷ß}ø ='qßÿÄ ( !1 AQaqð0¡ÁѱáñÿÚ ?ËЫp%{5ëÎgÔàPv :,ó\`¾ªr i=!hµ¼ !×ø¸ æÖ xí/·mB («2:cçisL¿3ÈõýE+Þ*Ò7ómÌãQDK:ð af$fT/5.Ê$oA¨7ÀªËn ÊfÛxQûR¨ 9ãÍåÚVñôÛúñª§Q¦SI+¡´ eƪä=öþý¥4;»:hå¸Ã©-C0¾1©qeÁѳ¤oÛ~ò>Ii[éÊmÚøå2·'ízJªÕÅF´4´z¸ÁÉIÊ/4ÏT?m~Ý"Al?Lev².¾» !ò£L T²[ç?+í <.\¾Ð«ã]ü³8|ª^º0&^ÿ .5Vmô.\½îÇ·£*@y=b£å.\| Ù °QõfRwÏ(a&GôÎUÉÞ L¨FpBñxöô,Âþ¡ ÿÄ ( !1AQaqð 0¡±ÁÑáñÿÚ ?HìÛÑØ'Ï9Ó bI9>×ä+ GåûzUÕ®èÉïÛ44½Æ|Û÷HÜ®«Æ±Þm1 Îc½õ¨õY DÉÄúÞôs¥RHzÜ¿ÚRÚL~£4ÈeßmèÙ3)Y´m1®¿ÖËÑ''³ôð£bãGoMG¹õ~4Û¿?u¬N'ã~ÉBGònR1ðü Z y¢EµÞÃõ¥FM¬ <ñÚ:Òå'¤üÇ2oÒÄ =( áɪ'pq¡ ¦-}u}Öûäz W©kÙbúðu#ÕöEEG¶*9Ô×þPü/6ͬ»EÂM&l§uÃRf¼(Îqåûi9 ÞY¨¨ùP7g~1D=ê~Éhl"¿#Ìp©2à×[*CÙLÿ jjW/§ÖëW;`¦¿#I´OÝë(¹CZ êúÕäh ±mï ©jGKÌÛj Eéù À²å+ >lÑÈA¼Ü¿à <ÔØ«®ø{ÐùIiI|3vì±bfVq>Ȩ÷Å%'íqrò±]L6Îu£ cÑnÕ-IWO[$ßrÖÿ (æLxãâd Â<ãÒvÊÀ·>of %¨êFÈ® Q÷M?2b¼0í:ÒE7Æðè»ürh)C7àówÚôx1:çÑùçmÈùé³D åH)Zx <µ Ù³ÀçªÀ~èå¾4¾²ÛüG§ÿÄ ' !1AQa 0@q¡ðñ±ÁÿÚ ?ú##öR?}>ÎáH"§"(rÙôÎAPBº©%Õ:! .ÆXè O²üûy4°^ãVÑq6æÃ˼¡áQKËSL+Í7(#á4qIS9EDO4âàáÐ b J Ü"¤ÊVÜÉ) Ø$®«ä×cS¡4N>· |}g;½qþ?¥?§ *ºåÊ6NR»pô/ ]ûÍÈÁCmA/~ fÇ7e$ ÈÏ/þãÅZUøpqªE[tpÐo4 =M;à þ^tgL$lX2ŧ!¾'Ó |>óõ;MÀ Èéý8F õÈ ¢VÒ#²âR] ® ZM(D0IÂé®ÍWJ ºa9ÆÝ[ ß³÷ )ê×f×ÖÜAM¢QÉJL6þJ W[¥÷ã ª° ;¨x¿8Ô¼IÂ®Í ·Þ §Ï'ðÁr¥ a:B<aÙ¼J®ÄÆðo¥Ñ RìxÞ X.ªÀyÕthØA,b·ç½¡o%vÐçÞràl¨AE-Þ¡ ªXá.V2% ®5#B5wJPE&¯\]ÿ ³ vKÛa)èÁl±®ÑPÎhÔ)ĤvBÓPOaA 6->",<$¯muURÝ×/ cípú¤LªÙm#D4 SÂ\]åÀp vÁr Q<,²qî×P4t` Ö8{ÈÜJ 7=*q.y] Õ¥Á,*<Dlê®C ²ý#Òfáø x%X¹ UB¸ v¡§ 4 §[ mME}Ã@1`X¯Ó«ª¤¢aÔkBOIçékÀ;Ï/y¾#®MdLQ6©tè'¥*TM@T ÐóñàQPÿ "m%zað:äì)J"`ÌD¤[KÀÍó/Ùä ¥WÚ×[%¬ À ÄRPR] ÐÎH.ü«UÁ bB»?Ø9&(OôÊòÀ߬¢i0Oé?y#ÁD! NÊÆ 1WGaÖ´¤wõº>¿V x2PÁ`q(b2> Ù½ kn]¨]¥ð"Ñ6ó (lHë 0 ÊÂoCË9Ü#VemÕ:0È m©IÏ5ÎÏ8é ¼h¾EðvZ r:¢BuNëA*«ÏUÐh4 l ÐFÖ9K0ð`×¼%zò<â@lPi7ÍtUO¨Gí'Ð.(Ê0ïã9²×8 TNÔ®41¥ 2a¶ù ¯°Óes¢ãG)ú_8ïÐ, W¸¾}mªtUVrÕk vMR*©ýÎ#BÔµ-[ ræró¡ u¸ò!R Z8NQ1×ÓÃêwÉô'ßÏO¢cN1¬,&W>þòb¶Pt&ÂDR, UPÄO#LG¬Ô:T¯u5åBôAÍ@¼ç.ûÏ'õg¿ÈäÕ@¼é Ê|ðÊÉ>ØÖùéòïôaóÿ a£DÝ×cËG] R'j)qÇÄ ½ I5C9ÚÅUÂ5ÄÐ4Ö%&H÷»ý¸ âOh*I¥t85£ ü wÊ@þr{Ù8À=è Â}«&é O±ôïâdr|ýä¦"|ñÈᨦLð`¨ÊvòhÍ#Ç ahL#§ TIÁBÄMËw¡ (Q#¤÷&ªüngcÒu ©¢åÂTxÉ¡²! V(BDËÅ;B t à?ÇiÞªÔ<ñüq]8êØô¢" É®°¹y] ©Çº©ÎbÐEjJjk:ÿ (t¨ ¸éjâ© Ñbi·Û uT=¡[? >ôxÈññÁÃ)·â 1C5Ø?¼51Ø_`»#¶%p4Þê X0JlÀà)Å ÕònÌÿ §QAS¦#¥ ºßÀÇÁQ¡}¢láåÒ%¡¤ hyZDØ¥§"*bô¤vPv>cõ÷(Òx}8FNE!A+¹¤)Ò`^È :%=+>]?k¼§ëåk ¼@pêÀ <ÍÆúqv0àÆ{OxgÃUI«Fj^MFËçxô=fè$SnÍä¬ ¦L-¨ZT §mþÐÎaö©>9~9Ç9¸Êx¢A9PCXrÜѤt×þwÆNÇBÎ`¨ 4 nRAm °¤ w®i<9NBV Óã Ð0ËAîÔy´äf¨XÚoMt Ñ2coXïj!лúÄÚÐGJoO^sKo ¢y)o`ÜA+?Çû¼H#`M¶¼3 töu_ÅĤÁÓXZ°¨Î öÛX9 UBóÜTåRDbuÎq·©¯¤©A±ðÐËcGcS¼4º+ûf$÷ ®¿£x1$£Dp ñ0^ð)cQDP 5f¬ÀÁD ;VåÒUú¬$ ,:M_È`;ÑM ëYKF IúDé(5ø©LDÄ sÁ³?ÕË!ÓÙ#Vuµ½,ÙhåÅ¿ °K¹)ØE#ë'Ïõðõ2Ï ±U"©JÚÀÙu¢! ¼t/EÝi3iªnn³ZZ¯ãCÆmÀçû9?¬@÷ÒV¤ È8& B?ÈìÏÓ ³t§¯jÀ ªñI%ÙF jËw/yÂ1# 80_ßÀ Ý4[¬T<"FÄjEcªK:ò ÄûXx2<êÉ÷¶/9>°¬0n/y¥×Y¶cÁ.kXÄcÃëieh4¥£Ï(QD§Oã4¡AÇ-¦# 8ú p ¤Å b× ]Îl±RoæL?!ÃØëIù3jqPíZ ExÇf"}ô=cââ''Ê>Câ XBZçLAç r[¯®ÓA7äÙ0Ïxà&Ü&ãA/J§°¦}0 ¥ bi=9¹~³õŤγª[bA!+|* _áCÁð}KadjÆ:ªBóE ¹Ð°¾ ëÛåÁdNZP $IYU<à âúÖyøåügÕÊ"Êù1AÜiRJ¶ õÞrùy aqk~ j x ba¼øá]ÑÙ êJDv&ÎZ:ÓlLSúÅÛú1ÀôX@Yí×)ÎQ¤«È4ðc¼yùyüeò¯¦Ø ÅÞ¢ª J¥b«ÍJ$ÙÕ4£kÁOë Qra*h*(râÙ4H ãA/I]ñ¶þ ~Uq'Ðø8£ðgÐë)ÇÃ5A¨Ñ =T8m6ÆÃÌ]8WMC òæS§t¢£Ñ*c²¤ð ªð ¥y°:ÁÚ}a$p Öáö|c !òZÒ S@ÊÁwà héCNßlÞ¾ "@w»»3içR`£ëÈxÇÃ?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 13969 |
| Response Body - size: 13,969 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ {ÅÞá¥{æ\Óbð78öJÙתH*HùÖrϵËéòVÙY1rÉ;¸ô5Ly0×°f× jâ6)Ô#³¤è4hÕvbRÒÞ·=òÚIv.s®No+ƽ)`©(u¡º»IR;âôyÓ¿^©ðv) ©Óê-¬j n(ñsäJS¶u^¡5&fÌfÈI4¶=ùåÜgôS¤±Õ#,ös%~¶ ©ÎäK£¥µeyÓ©kî4î¼ìç ³µ}Yèy¹Þ«ñæÙÈU@è¶ÍM¸XÊf !ÞCÓOhxnWbK¶Ë]ÐX] ë2%ct4µ¼ÐÄ£Ä$i/«=`ö ©¼õ{®ÂºzB×µlÜa¬½ [íY·°ékã|êÒZ&;åKu ;³¹A;Q1ÎméÒLª·IZ5 F[å4 tN ¦¼ÚÄ8@òx]¾RÍì'§~]ÄaتÃÎú:°<#,,ÐǶyÙØ+°EÈÀiÛcÅFÙSåÕ!LãvfëSmÊæ tkÍég!JýÀó@:5aËYì¼n Ìܧ¢dA£Þæ|íqõÎQE/y ß;ë7¨Wkf2àèº&LS¯:] ëÏvsÛåÑKOU®Ô¶µç§ihÀH ´X ¡'=ù¤Õ¦ª¤G©xYGÔíôû¼ ¾2CÅ´æ£Á¶õÈè[íÎ×%´æsRÆÚî=³´ i`8Ô`ãK³íg6¡n{ò è¨ì*,Ìæ¹Õ!ðuz¿ióJ|î»üͼ۪È5èðcÞØ9ö§cRnÓÙÆÚ VfÝ&Ñg'7;.âzFùK·= <½z3ãfçl¹d§}sªZ̧ ¯ËJuæ½ tÖ°úá :'Ð4w2G¢Ùi§3Z¶î4ÀÃÛdÒ uqfòó°áGêÇ=äëÒæVøÍØèuÊÆ>Ã+fÓGE·Áfmm`¼ÞîB ¡Kú ®7ò0Îóy lKw`À"ÑËL ²%g´ß íæ$d\étË5ÇY66×dÛUDÓ]ߨôGW)ät5-1u"+¨°ã«¾¤]']ôó=N&{+MlÞÞ{¼ÂCÃgVOËÌMṳ́¢~dzr<ÆËQaÑÉ1æ+ÜÌÊò?1ioG3qìÌd3Ì 3 !ÌZ¿· 4æ<ÚYYÝd÷ÿÄ ( ! "102AB#CDÿÚ zyTgÚ¹©GMäõß IÇ#Ú¡X.t¶Y ËÆ¥u_m%,ß$?ÊøﺸÈ^3Epë W,l jg«Mä~üw«Ëÿ )xè\hÙu©YMPvAbúé}ê¥|ä£â_;\iS²ªt¿ D{FËáCixÚodòÉTºÅiäOÔzØ«Búie²ß)Ø£DûU k® ) Âá3x4¢ë®/ýRý®,1Íq¤å¹+) Æ9aä]ùy1ÊSq I ÷ªÝ[Ã.×v&]ý|sM.ýS¢ãK'ÚT@_M'f]ÖÙÕÞUTÈ¡ ÷²-ÝØÞ%ìþ>,þµnñsNTÿ CKeêµòô.t¾ÞÝÇä+¯¨!Ö©vÍê©jÒª}pÙù®%,=ZV±.4r,¶]sæ 4õi ü:hË"¤9JµjÒ_¨¼ Í&ÿ ~Í-z«BãIÙæûÕK! ô_MãM'l`^ÙdÜÛ²¸èË#«z´ôe¤eé²-îöWéO ¸Òv íuú+4Ó±+º»/qU½³É½Öü{{ø·|¿3j£4ÍbÒ2ÃI^ÛïGìC {. ±Yc#^ÊÁBãM;º0R¼ùeÖ«¡at¬·ÅÊ¿¿VQò+"| 2gM2fûl[º;~oå \Jx=¹ÓNÇÌ]ÞJÏû>Uw ªT(RT¼«Ç=åî"ô~¹oÿ ß²?½;X.4ÑÍ#æöíeMö¥IJ¸Ø¼r4¬ q¿ ï}>dë®;J(Ñ!ÓºGÍïäÅ\Ø©hHHÁ\®W?#MObØÆI÷å tµÃ?gOQV·ÿ ´ÎÃ?) ¶(kQBBÝ õhâ¼ìå§ézj þoUÛ¯©É6½ñë#1B.P¾¨_UËÇÎéǧT|)%äTÓC%'9B&&&&oó¾ãìI÷Ãge©ö~HW×ñù.SôܤÇç¯Èüȹ%Ùçy åÚ»»E^óçq®pÍ7zÉò!Ûæ}ÒÍ4ÞXÆ> \îûrýJ]µaT|Q>$ÇBêüm Ô9«jr.uÿ óÒiñ¶VÙä8NRTGÆqù)¸NÈ/z¯]!äE¶Ç!¶Ì%¯Q µFo·oûS÷Â?ÓôFhB¹FaÔê*c¿ / ²L¢¿ñ²ß%«]<¹ÉOƵÿ ã§ÆÆÌoG?ñÿ 1[ÃmG] bØ´!\çadªR£ÜèEjåV ÁìQN<Id¿år×Üu%Æ %ÂÌuܤE_D/àÃY<1ÌQÁÛÃôaï©ëpí!Àêâô\`ëLn5SØã4ÄÅÊðÙf¬Á2Á¯`¿xKñ!ía8vNN.EÆJ´ßÃÖÊÔ¶«¥"7EBå}¡Q,x<&AzhöÂ^¥ÇT_AJgÆê\aª,ø¥Ó ®åa£¥Êû`Éú3¼/sôÑ_öÂÄWúÂØHF ìö ôÂTÅña.Ñò2PÙ¤/·ÿÄ ( ! 1"2A0Q#BCaqÿÚ ?1¿¡ôòMÛéòðMý.Ê)Aµ"ûS£"þÝ?ÇÓ®]uÙx±½Wtã~èôÇî¯âe qÇÓ ³%.NßD¬IGÜÇ'Uß S'¶¼ßfXS ½¬Q¶fýÇÉgzé9j?»ü hÅ*ÓðK W(Zf8îÉ+dý8ر(îD²^Ú7tÅTkçbÈx«h×F5¦Ey+B\vprc¬~<n^z$Ù麲¢Q^z£ìô$\D³ ìpú½HôÛ=$¾Ls|!åE·ø Ú#6ü1+Qªö9Wr$?IJÿ ¢90±Æ3òdz$Ýè%yWèycú9Ãô¸hâªÇ³ ZuÒ£ "ÉúíG«D²^ìt7 Äþ«¶ËÚvrÕHÛcÿ ¤[äÄîËÑ'jÎiêFH¸Ú=U/ñ§ð¯Áê¨* j"ê6BZd%zéËõ/Luî^:úìj/Á(¸é÷âÔ 2j(ö³÷<pØÌskFHÓ×dY5CìÿÄ ' !12A "Q0BaqRÿÚ ?$¼ëùi.ÆÐϧ»Æ=büiùi?{¡ÈXÆEÖÏIlïGÞ´N夥á VCßcÏ¡IYxdª!+D»gOä±!ßFèI¾}tR,oJÎÙå G°¶D}ÎË3Ë´Q¯SɽãÚ)Ù?o¹Ç$N}£Í!¼Þ(ÉE çÈitfe2¼¥V$äáϧðúõ|Ë0ó.LÒ3oT&¯SÕ¦¼É GDºôÎRÎ~Âùdb iÃö>:V$úr½1!ù_ìP&/ä÷ âؤXï£EÉð8_$¿Ì>'Ó½Ñ nF8ñÀ¡n¥ ئ¾Æ+Üfóþ ¶% #~Itë(TȬ #[Ĭ«1® «»ÖÙ[ÈdV^æKy$Mn®(Ú ì<®HËƸÈNõc ÞIiæ5¹>ÖGi(Ù~Þc?ÿÄ 1 !1 AQ"0aq@¡±2BR#ÁðÑÿÚ ?ÂEÂsP*i¦\=-¢ºæÇI Òé~éÎf[ÊÊ7¤¦»ùÒ9LkE&Ma ;" ®|èê *Õe$ɶ³-;pT u6Ý9¯IűB³¸uLúvÊ ç]t6¬(Ñ ´þ¬©®=ÉGªÜY~=øåEÞ»§§úÑxFº$i¥FêH¬ ÐÒ_j¦².x ºèè@ /U1¥ÕDhÉ0 iª7M%¾Èjºuµ¤Í=4IübCUo¾¨·2B`îº ¾ ¢,E5í\ho¢¤æôÕ#ò" ªiÇÐÕGíãböÆÑÎ"÷öÔfÈÅï Æ%Fa[/ñºß·ÖC´GûÄb>ØGb ^æèдî§çàÐ. qe¿áOÄcGÜé®4ÖA ãTà6Sn×Q#î¥Ùk°NÌ9tÓ0¤ïK¬ßÄIÊ!8ÇOܬ$]"G)³pn«kN2.Û `0kx®D{&ôðRôË%PéUò 7ÙUú¹ Éò¦ö«¡¢w·ýÿ S»UþQl§f å Äì`Ùÿ Jw+UA Ñ"@â~ØF ÌÈþ·º.Äàæ7 ö#^wSæbW BLP_FÂ}5k B.£a\Jó¨ \E«ç;©uO?OYTû ;¨5 Zdu=HêI°²Ìë.¸Þªÿ ]eÒå$Gàú,ßtÀ°ÛÝK^ G+oÍQsOÖÒG¾_¤/ÐÑYßúB>B ¢TÖrÄJ5o©ú ÿ ê#iH·jçdÕJû)ò¦òtU ¦£Ê¨]@"TUSݺélWÝKþÆ·ò¯áï×gºOª¨P/Ù¶ ßÑÓ ê¡·ÜpÒµNÎÙ B ÇáP8s&èÃÞ÷YsA_åË^Csø26ÝAé< )\z;a˽hd]ÖjÓ óÕ½w@ ¯8Q~ÅÔ´;%=éÊ%QÄÒ{pïS\óÒ 0ìæåÜú§NeüO%7æeÎv% O2tÒ6µvËÝz(ÜÛ£:(·Uú "Ò(TætÄHC§7ª !¾NoàÎqª¶Rm¦åeüý-F8xÂÂ1«(Ý ÀLÜ Ôøú 3|cLhñ<hñÄjp²æSÄ«!Ý_C«"ÔßLi7¾j¼ê°D6+ºøË^% ¦#ù*÷LcxìO 4PIåFúÍÔeo¨Nsº? (}Ô´éØÿÄ ( !1AQaq𡱠ÁÑáñ0ÿÚ ?!f K,²åß5 çðK-= 8 ο/µ.wí¸=4 xMÁÉ©gC²bàw?kéÖO^ó7Ðo¥½-e®;¥Þ´ÔËÛ @Ëä¾3`«â³TäS+êüTu9ADV§¹ïpý Ëè R0ß|ÔPÐ-íÐ=å A@?.ó Í»ÇÄ 8è=-¿èkÖ>aiNen(¢éë,´P¯/?Ô ¸ÐÍåÛÚQC]/Ì^:p!®ïç¡lSlï(8XbdÁ(Z¿ïî ÷¡¹o¸ve½Y÷!£i4._É+°qгl ÞB;3$°ëï?ø zd@Aeô¨aV+¡eø¼6E.Rákóÿ &°z2Ù| ýÙIA¸ëè¤=÷M?2ô±zZüzïT"«ïÀvÑó±\ïCC¡ÐéXº !çÌP±EóG«ZnÞY¬wÓña¥¥ð0 BX¯açÞ)q¤$W:¢0, ûÍaåô 6XhMaOù ]£¼Â&FZµ÷ûÁ6ÿ è=8¥Ü+o Ó ¦YÏ=¿2â\yxÌM¥ð%¿ì³S~ ¬5=¦}PÝÝb½=á RÈ×ÍTh¯Ç SáÚÝÂ8Êå{Á4Ôz\¸u0R ï¼¹AE® æ5wg¿],๠ÃæBÕ£cï¡ñÓplh^ Lt õJH uZ¬ÇyÛ¯Tq>ÿ ²©¤!® ×K._à ¡(khp¸0îÆh÷¯½á k.-Öxù¿xEj[ z ô¾ks÷Y¾è9KÆxÇ y³Ï˺ÿ f©¤5ÐÔ]à×EÏWN ÙE÷¨ N}&e_oÇh7ÔL1èàmÝáííPF"ÛU,S T ð.Ë·KrÇ{é î®ð __9 YDÒ¢Rá¹^ð¨¤ãDjüK±q£_{LpÉB/# bËïâõ¿ä9·½Seùàräï>É¥c RÆã:tdAU(Å{Í#´u*\æC¡¯ &$lª@þRªuqê(=JK.ðLs¥JïbÝ6MQ·°q;`Wlñ|ÂI˵G8óÎ&:ôAîÛ¿[Ag½Pè|͹Úî®,×}¡ .T¥{J±A# Û S] /GT¾f²î'gm{pCШM ËKû@ÁBfÞÊ((ÖØDû63éíº3ø*¶öûâ/©'?½¼J9«ÊÅOPîá.{°vWYê+¤ nMüÀõEs£UÇ~#jÏi¬2Ú¬7'Ïlãá ¡ÞYjÍxò¡ æ6jÃÓ D[ia`ªãØâ¢kuǸ1 !=ÜE¾!ëÜçæD<Aè*Bz «%]ï¿Ê\5TY˺ûq\ Lv¸èB£þ,à·ØûýDu `âüüÃ-`q¨RN^)6Õút¨C°rç´ì¤âçm©û*ÌÆÍ/}°îíÜ%ñAè ¨ñ4¸nwߺï*iÃCºr À¿ÑcPÆ© àǽ@¯ý*?Éû ,Õo1ó ¼Ú¦þâÇ»P ÜJµåè ¹|@ ê,Û¿µ3Öñ1´ÊYn Ç@AᾺM¿×SLÑ1»ø0g)zBÉSníÂG¿sæ5³´g`ví;òHX2=ÞÚ -å±[ xÿ ²ü û¾@|ß "Pd ¨Ø³ÛG¦ 8¦âM¡¸uÒmÐÔ7ÓNª8úYr¤ &q4ÀÙåòïº.íx}»nÃdÆ]Ýþñ$»ù^ݾaiP)dzXÆ¥ð6B8â(¿x0jh7 tt#Z1¡ÜÔ¹jWµ q² +EA Ð÷/ïþÅÒqÓݯÌ*¾ch>¶Ãé§AòÞè`¬È æx;`>¬U+»^»>íÁeêË´ã ûsYk¬Úåßë)ZÜâøâ9ù +rÙg- Õýâ]óSYà+^\ÄL ÚûÄ``îXê¢ñ³ è×X°I²sÌi2&2Di>HDÖÝ`= eÁK¨ò¡Æ` *En HO\Í9Á;äß jpR¯>5W99SïϬ¦VâÆ«? U÷0²ÕhÍoª ]ıcQ27OÎ[¸8¸¤çz 5Ç߸\}0ýÞ3 »*/Ñí1ðÁËÏùç&<%¿´±R Ó÷ Ì&[·¬îYgïÓÒ Z9q`,·díwÞ;$*ø´Ö¯çN»B&5(7\}¸*xÈÚТËx0 Rì·ýKk ÁGþ Ñ v1 Ë*î¹±?O¥1_´%üÅÂÍÝÿ QÛ%höÿ Î.3ÿ B;Jö÷L,m%Åa¶ïÖfa¦ ¦±;kzí_Ü2zåwòè¬c 8Û©hø²sÌf ÝÛWúï8NYÿ %çÁný¸®}ækKbN&3/Bhªî(´[QÕKÊ´Ðkû¤]×9\³à§~¶PÛT o ¦Óºâ+» ɹ{ÄmÑ¤Ò \Ðèôôh]]L ªH®;´,Ïû¹R¤ bó¸æ/®qeÀÀ5¼ü{Nö¢y |hc=ã²"«%2÷¸ªñvWEÔ° Ùò7[ßgHLãuj æav¡´/ Ár1M!¨CSH:@¸¥Jþ ;.Z( CQèÏH n³ÄÒhòÄ©ªpã8Ùл&ãî A¦ñ¬½¢X5µéfO Åmy{B wÐPÔ54t1 u©F,Ü\?HãÄÄg¤¡Ã ã í»ûë a¯ÆaEX.>ñQ9V m8ÀgÄÊN fÇCO¹taâ8Öð§y¸9Ö:K£ho¦N¹1>NSk¡À ^;Ë Ì׶7Ðsq&!¥ly©G=Ȧ,ÞüNMS}`FáÉÞ$NgGãÂf;ñ¹T®§Ì · #g Pé¤7Ðèt©/}Ú9ÒRA.Á«kÏrïµþ¥ ¿Û£ 6àÍLÏ ½3n4j@ VÑ2ÑýÃmL sH@Ó`ªe½1Ú§ã·Ô±<^!aö»Çõ@&kR Ýeqt uÿÚ ©¼Å· ×Ýðz ¥¢àu¿ªawdÒøCÉþ&!ôý@6ßMí[T¬D #ÄÅ¥KUÅ;Ð×âBò´fbTÙ5ÚþÂj¼·KÞMÈÖáõc©A Ó*OÙmW°úÁ²Q*C븥iÅñdªýRq¸aÆ%Ñâò Y´Mͤ¶FÚóð÷IÄ£%ÍPQæbàwùZæãCd'Щu2ñÿ B| ~?] ÷ùÿ <ÿÄ ( !1AQð aq¡±Á0ÑáñÿÚ ?ÿ Ø)Oe®zã㯳,_ÏUmù- ~#Z*+%À9õ¿ ϾÏNqo,h ]ïëÉce0ELîûÔ·^S¯ÌøQPÔ¸<_YÙ<TBLÅàþüøçPú´aæQh!ÉÓ ®&9Ñá©Öü÷ß¾`]D¢â0ú´Ðjb®ÉYzCÍÆbßÖæ)Qúãñ<¼Ó=ñë3sÞûô\Fûâ 1UÒG=bs ùI ôÖ¾ø'ÖuE/Á¤&rà qññ.Xâ©Éï[eã±Wí¦Dà I{uZ76µ¤"°+½âô¯û¿â;ø4ÌÇeïÙ¯#Pjá/¾øûEüWñõæêV×HpÊ?Á6Ô^h8vþ~~¥¯Lýw¾Ø_Ìæ3u_ÜG߶¢ ¼ê:FIW¨*¹¾ß´3¡Å±ÌñÁ)Ý_ÌO{'¼³Åm7e È©òÚW¸dêd h¬þ%ée`h¤míWîzCU(Äòì·£öK¨&Ïxj¹ÔÈzLßj]³L«m]ÿ ÏMBË¿©|á¯Wý~E9<øÆð~Á,Tȳ¶pD: WÐxFDë_°9. kÉÿÄ ( !1AQqð a¡±ÁÑáñ0ÿÚ ?´4à-Í«ß¡ p3lm| |G«YR¥{yW¿{ðvü`¸1à k)£*:pêó§ veË . f·wó ÑÁ£o -2ýqKåÅÊXó%Ô6me¬#BÙóç½ae¥jð=PÞiß}`¸àÍJ:Fé4`áÙù×￨¥M\zÍm6 b°õCÉËàZË.X9tÌ 9|CQÒ¼ÝóÔÇ(x8`W¬sÿ %FÎaª9ý09F~Ê ÿ Q²g ¡8#TÉD°ß¾rý½ oSN×\|Áó0ysrëûìÕóý ´fdjãÓ»»¶fºûi [T Å]!½æO ¤ÓÂB áÒhÆÏ=}óE^¦Ðª%{GëßÜC飪ÿ ÚvõÓêÁ4*ù+î«óýNøĸSüµí´ú°B õJÓÏxïÞv½»ÞóÇ¿ì\«ñß}!pV+X)WÞ`V Æ· *ºÍÖþ#/ò9-Ü÷¤¯!ué5m°ôo( õLÓÞ; ßTX±dÖ< ^" zX÷?®ôÐ WÎß©GÌúG3â éöE=cë¬#ª][TðJbÈ%ìJEErC/Ô°<å C0ÛÊTêK"¶¼õ» (síYà*"®~?r¦VË0V&Sx@Ëxß ªzüDvÙ¨A4ðÿ ÿÄ & !1AQaq¡ð±ÁÑáñÿÚ ?P®:PRÀ0{sÞ7IæUáz9Ü6êÐáÀve8Ö@0 cÏ}tÃ(騲ðÏ ~°ä]å|¹= àCU¡B ¿×s6hÑ[9åß÷Ë°ø± ox- °Ú|gX «B f°äÒbUÏ(ZáË ù~=Ø£é¯y¦ø´ýx ¬'Ð hàÚ=®¹È×}*¯hRq ÊÔ§Z#Eº5NÓ!UÑíÎ³ï£ 4¿ ^r8ÃÍ¡@ÿ ÒyW^×}×y1]5O¼5ClKa|^2¥¦(ìòzêOä~ò<#\fÈ:iw8êrzÎ6[º'Ý×Î>LSNÌCmfàÂB·T³N¾$m-P5ZR¿, @<cÃxi wçé,T@B®èraIÌk8&ÍÇçê;àRKñúé§4C¥e㨽'.P \hñãY!¬ï ùaßãñ¹ÿ X'qëçÄ Õºuæ|Ls!L´«[U½róÝÁ³=Ù¡}äöÁÑSæYÇûÒ*;PùùÉÙÍKõJ\ÅDèt8@½ªùÊÙr'«3Vä7ÚM&%Àk½@ ©F.0üÆs|â£ÖOO L Çò «Ë@rX =êäò°¸B¼8ã±/&+ªÏ qç§Àñò¡/.µ@<~4`ñÓñÛðµ? 1 s. wê@" ®÷%j¤ G9pä1¦[¦¢ZO<@XN×Îîi×Ö>&N¯U´XJ®·®,¯N ÖSfQ˨N¯Æ µ(åx mÒMÌ@Q ÍïÆh¬qq+Xõɨ Ü«Ú¡N<¹úêÒ=-¼¼µÀ¡ÄwxÐ ¤¯-äíªjÞlÀ¶ygççy0ÖðDÁ Ïòg#ðãøQ¸4ÖHÄ:YjݽíÊn-_Ö)°mAèßU÷@Ä ¶<(S\3_dðcYI(J~BÁTEjÿ ¿»Î{£6ßxtaÒ_ÜÂÙ¬ pïY¨ 0¸ú`,·Û p_oæ» h z ¼1cáÀ3ßÎ,æ`B¿²QgÐýfõ_,1¤¾»SÀâütl qÍpæ$ß»Zíû`p7ÞnôaÇÏãøT÷ø¦eñù F»¤].µîsÑL(ÑëÆGtÄfDo¤KÁL5hb¼ãî¹¹Úð ÍÌ1Aw67Èøý³O"xËr<ÿ bB#3Æïs j V þøÖñd7ºÑ̦ìÁà1Å<ç¬÷`_y]¢GºÞ5"!" ZêYã ]ºÐé'Nwy⯠*° £ ÜøÁ+Î =§àh8£pi¬uüþ{Àdz§¦aj4Òy× ðs¢Ç\ñ¯.RûÁ9 ?LÙlÞ¯3ûþ1Ó,$áçT!µB6U <ÆOOáÐâ ·ÏÃÉÜGÇ ÃÏ«0K1$ÅWqó¾³bVÕò\ZL7pÎ*kÆ=¼ÇCüò1VÈv¾4sæ~æ¢IÝC®?WÂ4`, àøǤÅJe°GqïY L' 3>f. sA¾ç÷XÔxàF¡ä»<P{@øsÁÎd5TBEjW]k4u/YT!À¦x|Ë£µÉµ*KV¾ûÍXÉËS jí«½)¶Sa?oî¸þðÙ¸æ¼ÌÒkÕP«:Ør+ÀÄV@ä-vh6³XyCnX ? 5LiòÄáïX G é® ¥JºÂÍà¤À/Æ yöC}5 kç²A¤h]3%ýÏàÛ¬F!R _ïXÐÀ4+ÐfÚ£æT#áÊa ¤{kü¯ pÜ¢ÞI1AYc ÁU×k;ÇE H íî wÆÜ >Îð!µæ à¡1X¤¿Þ3Ïlqfn¦ÀßÏM©ªÙÄÐ_X(BwüíßxxÃöÎ,teózÀ<8;ÃØf)ÁúÂ}|ñ¹Á·[Âf Ey6ëÚëÈ" MPV¸yÄ$¦ ñ@ ÂÚrHxÔì$*!í º|1<A!|kË«±ÀºÑ1SÏ 8 ɾ2²_xx[úĦ=§#Màt0"( mzñ[ ®ú¿ï ©Èì9þCôýä ®r bh®N-;"Æy7¥å¿îïXj»Q¿£àwX {poi¬2 qøpÇæ}ä´S¢ñ^°£ ,(Ũïr 7 ó{±ÚxÁaÁ%Ù¦|Æ=Eº¥¨1ì6©½ñy)³ßÙ¤Îw\®Íål@x3cüZ"½LYuMmÑ)&ÆÔ\§";rT ÂñÁ}Ì r ¸D¥wûK¾ù·ýÑíÊRÏ' D}å rç`~ðùÄ(,gUùrÆT¦ À«ðÊa- ®86:yç_µaIôj!¢Ã @½ØHòÊ#E §e6;0dñ"µ !ÀMMï¯9¬ ષ¾£ÁLâæ¡ìËlç½9ì ²Yû 1\ÆÊ;ÄÒT?Iº HÂ4 Øv^C+I*C1v¼ó´¥ *$ ÙÆ *È=ª/LKQv+uîçÛ¨ìÉ8ëQÝæÒ1ÍUÝg¾¾8éeGã8£¢àNwGç ì¥øƳm]9Þü°0Æ;¸ tj£ªÔîMr9`J;éýç0°é|cRDÐ;r¥aÐÂË{TªÛÀ¯bÚ¸ªíýùÅRôC1» è8JrÁz·|+;.¸®|dã ]æëÃ;¼±!ñÆ+mBfPèîüÿ ¹¢A§h/°'º¬ÚkÐòb&wqs]ÀLîàÙïX ¼ «d½¬Ö9\%Ô??Xm<ÉãFu Î[na/ÆñNP ±!ìEô°Ý,¨ %8äbþ©sãç@¡i×TIÃ@XZѹ»º]#Î 4 v # ',F UÇ H"y"ο EEÒO3¾m$ Ð8'õÉ2ëÖùqÓ~Y¸~ð8v!ÿ óÎM,Ðß 6 ñúh !H£Òïno¤få7¢l7Ö-Þ¾¼ÿ ×Îk0Ö)¬ ÙúÎ×; ÖQ¯CÈ·Wð°ÔNÖõxò]c¡ÁË ¢ÑtÄøDONw´çl"s\ð] ®±w3%ÐÉÒ'§ n:JPúPvì½UgÅ#ß¾ X :$UwM$â Lî &§»¡ô hf×A¾\W´ 9 Ò ¹õµdR©U{\¼ M µñDÒ#E*9 ÊÑD®ûÔ¸ iÿ ì÷RÕU¼ÝóiÆ°Î0¹w C¬4 a¢à ü&pç7Çç·ãOÃ@é1*°ÖQ:6ðp£¬#N4Ù¾üq8Áe`°Ðm` \¦ ¨Xä0GËØRÆû?o mþMæÓ¥ßNjoF§¨Þ7|5ÌGe-G0 ½ñ¬Ôè Uµv¼Ð !³m`l?Êb#cÐÙÇî²mAà4{VëDjBF¶úÈ_/8'XZûÁǼÿ àú³ùb,p\Q ÀÐqðñ|¿sð\<~x8Ænä\QcÏ9Q[ßýþܨ< E"SQ©÷aá@5Xj Åçf ¸¨: ÐsÁkLw PZ ®õÅ ,ÝAÓ¦@ØEUÆã+µBN« Ðu OÀ½`kX8$Áã8ÿ u#÷ËÏ7¼O9×öÉéã?S; Ëéç,õJe´ó7Ç4ñ&6£ë]uûX¦Ï?ß÷,Ü©7M;a|¸: B¼®ÕUbR ïk}84JS ó:~Þ¡¢VÆɾËGAÊp^y ê`$`é ( iux $l!8 ¢ atéMè¢=ØK¹Ñ Æi*MB2õ5&¦ÅäRHh£ºÉú©±#Vv-Ò)¯ëmÞ°PJ-¥ËBrí¶èÐNX1 ÿ _¼H]iPÉðGZ]SùÇ0zØiÝÒwàÑ~hºÑ«;>g9Ôí @TÞºS~hô@ÄÝçw]Fò$ÏtÕ> Ýx ñç@VppÚ;¼³õ{Â[> Tb<òs¦/3ª¿ ;×Å˯(÷¿Ýªæë¨ðØA"ëbO?§/?^·øû<à7ä6°?ja´DóÀþ3`&óögÀ¾°p¦ \#ElÁt}þÌ 8 ØÊ:ÓöL Ù(èdä_@¥º>æ²@¢Tyª´QÜíó A+µy»µÑÍÆËIü yôå DGpéz_óÞ÷âÊODå¿Æ"7 #C0ðpÝ&3¬ { Ä9×®jLª ©4Zhxy Ù÷óíH,<Ãn®¯Ì>À*%3H/Hßt?¬¤ sÉb°ð¦ñ±=\P ÿ ÕÁÃÓu+NA²5²G*¥ ]ôT&;Jèy& 5. ¥A çç¬:'`¾Õ d¤À6kÉýe# ¥ §{øãR 0wiG®nظ¨426 EïR½ Ú(û {Pì@ ¦°ÓQ ¡YÁAû1iAJóS©¯=î0kh*ò>¾yþìY6: O¸$ N§+ØÍwrÅkÜ9'ë ¹f¡A%õ¬SFËä?æ,ªð¨»£ûßxÛýófÑÙìv#A)f¼õ¯ÎC0 ±ó°úËÂQ¨²Î B˼êf$>±ÙWfõ¼ï\:¾s9ÍðÍ°?xVùÀ¾\sëÒ{ÁÉè0I¢d¿@|0Uw^s6ÕZ¼óéºÝµXâþÕÛã}ê \AùDlâpvÒ0 °ìíMýa KX BÑ>$¼ [ÐÛËÙ ¥ 9Æb6£öß/§Æ$8B¸ixt { ê«và x0J¡;;| y0{Õxï 99,WÖ*ZÎÊlá»×Ky'ýfVût:?\ Þd#}öuÎmÀ G0 ,X 2bõ5AØ;{ø×ïX<Æϧü·@`ð`$ó;áÀ,{s±ÎçÐ0wà½á_õ}`óñ e>4}Bñ¨3èÐU@tEÐYýÝmI}ùÁâ=ÝHm HÀ1òÄ ¤Sm¦Õ4kÉ`^4 ~°ËÖ=þÉR"+8¦¡@(åxÄuHÙÓëG8Þü óÕ¡¸Ô£78ß'xÀC»Þùÿ _XX»ûÃ198¡xJsLh !èþÿ <`[æÍÄüE_Õ=]ïÛÞh5Hÿ 8hõ Ç1_p|gg ]¹G| ùb-`ðO ðFÑî}dç4cTg8§T-jÞyjqö .µ¼4¢6FÎ9ýf¥v¼¯xÀL°¼éßêjåm1ªÝÝ¥Õ^/É7Çëj @ ûk¦ó Í3h$GV¼#z '÷ÆP³A÷=fÆÃ÷èTxf ¢u³§àìáÀáh@W\ ñL Ò±ÏÑ ôÂNu'f:1Ñß8(úüS0 Öà{ÄÒÔ<RAõÉÙáƨ軨¥ò ]%m È =` ¼Ñÿ ]äUÞDÞ=|+2 3tÙiÏغÒVÓj·Nþr] Ê ª ul%Ã,~K2¼G< w.ç'¼5é?Þÿ y³UÊÀz=â¦T%' p¿x/b(µ´gòg]Hü)P×Kå)ÿ p¢¡¨ú %×ß<cÀ-iaRÈ:áÞ ûÂ㧠&<p|þ@¬ü ᬠÃ!¿CËï$53èÊ¥ÑYÃ~ ú&hæÙà.mÖ:B,½½òäÖÊvÕ÷¿åÎ8´Òüõ qz½7#E¢é¶ õ¸Ø$Gûç çÑËI¸{eë^pDu@=â³ç o¾Þ0 !7>± Ã}ÃèŧÜt çMÑù"D@DDËÚxãvQcH)ºðèãÈøضÁzÞ°³ Ñ2»ìÅJ`Ðàëða5³5·XÏN¸ §÷ï àÈð!!ÏbG ¬ÐH 60j ï{þ;ÃL¯0 ÷ëö[ÂNFq(w¹,D¬ Ãüå?yN 6'#ëUÛ²$¼¾tÍñÍT _ï<lË 8( ïúÄ<ϬnãéÌÔWR2½¿\Ð?Xu«4¼"ÔIKp± Bhõ®Ânö<?§Si >5ÞðüëgQ Ìr~?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg&size=160 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/4.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 13969 |
| Response Body - size: 13,969 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ {ÅÞá¥{æ\Óbð78öJÙתH*HùÖrϵËéòVÙY1rÉ;¸ô5Ly0×°f× jâ6)Ô#³¤è4hÕvbRÒÞ·=òÚIv.s®No+ƽ)`©(u¡º»IR;âôyÓ¿^©ðv) ©Óê-¬j n(ñsäJS¶u^¡5&fÌfÈI4¶=ùåÜgôS¤±Õ#,ös%~¶ ©ÎäK£¥µeyÓ©kî4î¼ìç ³µ}Yèy¹Þ«ñæÙÈU@è¶ÍM¸XÊf !ÞCÓOhxnWbK¶Ë]ÐX] ë2%ct4µ¼ÐÄ£Ä$i/«=`ö ©¼õ{®ÂºzB×µlÜa¬½ [íY·°ékã|êÒZ&;åKu ;³¹A;Q1ÎméÒLª·IZ5 F[å4 tN ¦¼ÚÄ8@òx]¾RÍì'§~]ÄaتÃÎú:°<#,,ÐǶyÙØ+°EÈÀiÛcÅFÙSåÕ!LãvfëSmÊæ tkÍég!JýÀó@:5aËYì¼n Ìܧ¢dA£Þæ|íqõÎQE/y ß;ë7¨Wkf2àèº&LS¯:] ëÏvsÛåÑKOU®Ô¶µç§ihÀH ´X ¡'=ù¤Õ¦ª¤G©xYGÔíôû¼ ¾2CÅ´æ£Á¶õÈè[íÎ×%´æsRÆÚî=³´ i`8Ô`ãK³íg6¡n{ò è¨ì*,Ìæ¹Õ!ðuz¿ióJ|î»üͼ۪È5èðcÞØ9ö§cRnÓÙÆÚ VfÝ&Ñg'7;.âzFùK·= <½z3ãfçl¹d§}sªZ̧ ¯ËJuæ½ tÖ°úá :'Ð4w2G¢Ùi§3Z¶î4ÀÃÛdÒ uqfòó°áGêÇ=äëÒæVøÍØèuÊÆ>Ã+fÓGE·Áfmm`¼ÞîB ¡Kú ®7ò0Îóy lKw`À"ÑËL ²%g´ß íæ$d\étË5ÇY66×dÛUDÓ]ߨôGW)ät5-1u"+¨°ã«¾¤]']ôó=N&{+MlÞÞ{¼ÂCÃgVOËÌMṳ́¢~dzr<ÆËQaÑÉ1æ+ÜÌÊò?1ioG3qìÌd3Ì 3 !ÌZ¿· 4æ<ÚYYÝd÷ÿÄ ( ! "102AB#CDÿÚ zyTgÚ¹©GMäõß IÇ#Ú¡X.t¶Y ËÆ¥u_m%,ß$?ÊøﺸÈ^3Epë W,l jg«Mä~üw«Ëÿ )xè\hÙu©YMPvAbúé}ê¥|ä£â_;\iS²ªt¿ D{FËáCixÚodòÉTºÅiäOÔzØ«Búie²ß)Ø£DûU k® ) Âá3x4¢ë®/ýRý®,1Íq¤å¹+) Æ9aä]ùy1ÊSq I ÷ªÝ[Ã.×v&]ý|sM.ýS¢ãK'ÚT@_M'f]ÖÙÕÞUTÈ¡ ÷²-ÝØÞ%ìþ>,þµnñsNTÿ CKeêµòô.t¾ÞÝÇä+¯¨!Ö©vÍê©jÒª}pÙù®%,=ZV±.4r,¶]sæ 4õi ü:hË"¤9JµjÒ_¨¼ Í&ÿ ~Í-z«BãIÙæûÕK! ô_MãM'l`^ÙdÜÛ²¸èË#«z´ôe¤eé²-îöWéO ¸Òv íuú+4Ó±+º»/qU½³É½Öü{{ø·|¿3j£4ÍbÒ2ÃI^ÛïGìC {. ±Yc#^ÊÁBãM;º0R¼ùeÖ«¡at¬·ÅÊ¿¿VQò+"| 2gM2fûl[º;~oå \Jx=¹ÓNÇÌ]ÞJÏû>Uw ªT(RT¼«Ç=åî"ô~¹oÿ ß²?½;X.4ÑÍ#æöíeMö¥IJ¸Ø¼r4¬ q¿ ï}>dë®;J(Ñ!ÓºGÍïäÅ\Ø©hHHÁ\®W?#MObØÆI÷å tµÃ?gOQV·ÿ ´ÎÃ?) ¶(kQBBÝ õhâ¼ìå§ézj þoUÛ¯©É6½ñë#1B.P¾¨_UËÇÎéǧT|)%äTÓC%'9B&&&&oó¾ãìI÷Ãge©ö~HW×ñù.SôܤÇç¯Èüȹ%Ùçy åÚ»»E^óçq®pÍ7zÉò!Ûæ}ÒÍ4ÞXÆ> \îûrýJ]µaT|Q>$ÇBêüm Ô9«jr.uÿ óÒiñ¶VÙä8NRTGÆqù)¸NÈ/z¯]!äE¶Ç!¶Ì%¯Q µFo·oûS÷Â?ÓôFhB¹FaÔê*c¿ / ²L¢¿ñ²ß%«]<¹ÉOƵÿ ã§ÆÆÌoG?ñÿ 1[ÃmG] bØ´!\çadªR£ÜèEjåV ÁìQN<Id¿år×Üu%Æ %ÂÌuܤE_D/àÃY<1ÌQÁÛÃôaï©ëpí!Àêâô\`ëLn5SØã4ÄÅÊðÙf¬Á2Á¯`¿xKñ!ía8vNN.EÆJ´ßÃÖÊÔ¶«¥"7EBå}¡Q,x<&AzhöÂ^¥ÇT_AJgÆê\aª,ø¥Ó ®åa£¥Êû`Éú3¼/sôÑ_öÂÄWúÂØHF ìö ôÂTÅña.Ñò2PÙ¤/·ÿÄ ( ! 1"2A0Q#BCaqÿÚ ?1¿¡ôòMÛéòðMý.Ê)Aµ"ûS£"þÝ?ÇÓ®]uÙx±½Wtã~èôÇî¯âe qÇÓ ³%.NßD¬IGÜÇ'Uß S'¶¼ßfXS ½¬Q¶fýÇÉgzé9j?»ü hÅ*ÓðK W(Zf8îÉ+dý8ر(îD²^Ú7tÅTkçbÈx«h×F5¦Ey+B\vprc¬~<n^z$Ù麲¢Q^z£ìô$\D³ ìpú½HôÛ=$¾Ls|!åE·ø Ú#6ü1+Qªö9Wr$?IJÿ ¢90±Æ3òdz$Ýè%yWèycú9Ãô¸hâªÇ³ ZuÒ£ "ÉúíG«D²^ìt7 Äþ«¶ËÚvrÕHÛcÿ ¤[äÄîËÑ'jÎiêFH¸Ú=U/ñ§ð¯Áê¨* j"ê6BZd%zéËõ/Luî^:úìj/Á(¸é÷âÔ 2j(ö³÷<pØÌskFHÓ×dY5CìÿÄ ' !12A "Q0BaqRÿÚ ?$¼ëùi.ÆÐϧ»Æ=büiùi?{¡ÈXÆEÖÏIlïGÞ´N夥á VCßcÏ¡IYxdª!+D»gOä±!ßFèI¾}tR,oJÎÙå G°¶D}ÎË3Ë´Q¯SɽãÚ)Ù?o¹Ç$N}£Í!¼Þ(ÉE çÈitfe2¼¥V$äáϧðúõ|Ë0ó.LÒ3oT&¯SÕ¦¼É GDºôÎRÎ~Âùdb iÃö>:V$úr½1!ù_ìP&/ä÷ âؤXï£EÉð8_$¿Ì>'Ó½Ñ nF8ñÀ¡n¥ ئ¾Æ+Üfóþ ¶% #~Itë(TȬ #[Ĭ«1® «»ÖÙ[ÈdV^æKy$Mn®(Ú ì<®HËƸÈNõc ÞIiæ5¹>ÖGi(Ù~Þc?ÿÄ 1 !1 AQ"0aq@¡±2BR#ÁðÑÿÚ ?ÂEÂsP*i¦\=-¢ºæÇI Òé~éÎf[ÊÊ7¤¦»ùÒ9LkE&Ma ;" ®|èê *Õe$ɶ³-;pT u6Ý9¯IűB³¸uLúvÊ ç]t6¬(Ñ ´þ¬©®=ÉGªÜY~=øåEÞ»§§úÑxFº$i¥FêH¬ ÐÒ_j¦².x ºèè@ /U1¥ÕDhÉ0 iª7M%¾Èjºuµ¤Í=4IübCUo¾¨·2B`îº ¾ ¢,E5í\ho¢¤æôÕ#ò" ªiÇÐÕGíãböÆÑÎ"÷öÔfÈÅï Æ%Fa[/ñºß·ÖC´GûÄb>ØGb ^æèдî§çàÐ. qe¿áOÄcGÜé®4ÖA ãTà6Sn×Q#î¥Ùk°NÌ9tÓ0¤ïK¬ßÄIÊ!8ÇOܬ$]"G)³pn«kN2.Û `0kx®D{&ôðRôË%PéUò 7ÙUú¹ Éò¦ö«¡¢w·ýÿ S»UþQl§f å Äì`Ùÿ Jw+UA Ñ"@â~ØF ÌÈþ·º.Äàæ7 ö#^wSæbW BLP_FÂ}5k B.£a\Jó¨ \E«ç;©uO?OYTû ;¨5 Zdu=HêI°²Ìë.¸Þªÿ ]eÒå$Gàú,ßtÀ°ÛÝK^ G+oÍQsOÖÒG¾_¤/ÐÑYßúB>B ¢TÖrÄJ5o©ú ÿ ê#iH·jçdÕJû)ò¦òtU ¦£Ê¨]@"TUSݺélWÝKþÆ·ò¯áï×gºOª¨P/Ù¶ ßÑÓ ê¡·ÜpÒµNÎÙ B ÇáP8s&èÃÞ÷YsA_åË^Csø26ÝAé< )\z;a˽hd]ÖjÓ óÕ½w@ ¯8Q~ÅÔ´;%=éÊ%QÄÒ{pïS\óÒ 0ìæåÜú§NeüO%7æeÎv% O2tÒ6µvËÝz(ÜÛ£:(·Uú "Ò(TætÄHC§7ª !¾NoàÎqª¶Rm¦åeüý-F8xÂÂ1«(Ý ÀLÜ Ôøú 3|cLhñ<hñÄjp²æSÄ«!Ý_C«"ÔßLi7¾j¼ê°D6+ºøË^% ¦#ù*÷LcxìO 4PIåFúÍÔeo¨Nsº? (}Ô´éØÿÄ ( !1AQaq𡱠ÁÑáñ0ÿÚ ?!f K,²åß5 çðK-= 8 ο/µ.wí¸=4 xMÁÉ©gC²bàw?kéÖO^ó7Ðo¥½-e®;¥Þ´ÔËÛ @Ëä¾3`«â³TäS+êüTu9ADV§¹ïpý Ëè R0ß|ÔPÐ-íÐ=å A@?.ó Í»ÇÄ 8è=-¿èkÖ>aiNen(¢éë,´P¯/?Ô ¸ÐÍåÛÚQC]/Ì^:p!®ïç¡lSlï(8XbdÁ(Z¿ïî ÷¡¹o¸ve½Y÷!£i4._É+°qгl ÞB;3$°ëï?ø zd@Aeô¨aV+¡eø¼6E.Rákóÿ &°z2Ù| ýÙIA¸ëè¤=÷M?2ô±zZüzïT"«ïÀvÑó±\ïCC¡ÐéXº !çÌP±EóG«ZnÞY¬wÓña¥¥ð0 BX¯açÞ)q¤$W:¢0, ûÍaåô 6XhMaOù ]£¼Â&FZµ÷ûÁ6ÿ è=8¥Ü+o Ó ¦YÏ=¿2â\yxÌM¥ð%¿ì³S~ ¬5=¦}PÝÝb½=á RÈ×ÍTh¯Ç SáÚÝÂ8Êå{Á4Ôz\¸u0R ï¼¹AE® æ5wg¿],๠ÃæBÕ£cï¡ñÓplh^ Lt õJH uZ¬ÇyÛ¯Tq>ÿ ²©¤!® ×K._à ¡(khp¸0îÆh÷¯½á k.-Öxù¿xEj[ z ô¾ks÷Y¾è9KÆxÇ y³Ï˺ÿ f©¤5ÐÔ]à×EÏWN ÙE÷¨ N}&e_oÇh7ÔL1èàmÝáííPF"ÛU,S T ð.Ë·KrÇ{é î®ð __9 YDÒ¢Rá¹^ð¨¤ãDjüK±q£_{LpÉB/# bËïâõ¿ä9·½Seùàräï>É¥c RÆã:tdAU(Å{Í#´u*\æC¡¯ &$lª@þRªuqê(=JK.ðLs¥JïbÝ6MQ·°q;`Wlñ|ÂI˵G8óÎ&:ôAîÛ¿[Ag½Pè|͹Úî®,×}¡ .T¥{J±A# Û S] /GT¾f²î'gm{pCШM ËKû@ÁBfÞÊ((ÖØDû63éíº3ø*¶öûâ/©'?½¼J9«ÊÅOPîá.{°vWYê+¤ nMüÀõEs£UÇ~#jÏi¬2Ú¬7'Ïlãá ¡ÞYjÍxò¡ æ6jÃÓ D[ia`ªãØâ¢kuǸ1 !=ÜE¾!ëÜçæD<Aè*Bz «%]ï¿Ê\5TY˺ûq\ Lv¸èB£þ,à·ØûýDu `âüüÃ-`q¨RN^)6Õút¨C°rç´ì¤âçm©û*ÌÆÍ/}°îíÜ%ñAè ¨ñ4¸nwߺï*iÃCºr À¿ÑcPÆ© àǽ@¯ý*?Éû ,Õo1ó ¼Ú¦þâÇ»P ÜJµåè ¹|@ ê,Û¿µ3Öñ1´ÊYn Ç@AᾺM¿×SLÑ1»ø0g)zBÉSníÂG¿sæ5³´g`ví;òHX2=ÞÚ -å±[ xÿ ²ü û¾@|ß "Pd ¨Ø³ÛG¦ 8¦âM¡¸uÒmÐÔ7ÓNª8úYr¤ &q4ÀÙåòïº.íx}»nÃdÆ]Ýþñ$»ù^ݾaiP)dzXÆ¥ð6B8â(¿x0jh7 tt#Z1¡ÜÔ¹jWµ q² +EA Ð÷/ïþÅÒqÓݯÌ*¾ch>¶Ãé§AòÞè`¬È æx;`>¬U+»^»>íÁeêË´ã ûsYk¬Úåßë)ZÜâøâ9ù +rÙg- Õýâ]óSYà+^\ÄL ÚûÄ``îXê¢ñ³ è×X°I²sÌi2&2Di>HDÖÝ`= eÁK¨ò¡Æ` *En HO\Í9Á;äß jpR¯>5W99SïϬ¦VâÆ«? U÷0²ÕhÍoª ]ıcQ27OÎ[¸8¸¤çz 5Ç߸\}0ýÞ3 »*/Ñí1ðÁËÏùç&<%¿´±R Ó÷ Ì&[·¬îYgïÓÒ Z9q`,·díwÞ;$*ø´Ö¯çN»B&5(7\}¸*xÈÚТËx0 Rì·ýKk ÁGþ Ñ v1 Ë*î¹±?O¥1_´%üÅÂÍÝÿ QÛ%höÿ Î.3ÿ B;Jö÷L,m%Åa¶ïÖfa¦ ¦±;kzí_Ü2zåwòè¬c 8Û©hø²sÌf ÝÛWúï8NYÿ %çÁný¸®}ækKbN&3/Bhªî(´[QÕKÊ´Ðkû¤]×9\³à§~¶PÛT o ¦Óºâ+» ɹ{ÄmÑ¤Ò \Ðèôôh]]L ªH®;´,Ïû¹R¤ bó¸æ/®qeÀÀ5¼ü{Nö¢y |hc=ã²"«%2÷¸ªñvWEÔ° Ùò7[ßgHLãuj æav¡´/ Ár1M!¨CSH:@¸¥Jþ ;.Z( CQèÏH n³ÄÒhòÄ©ªpã8Ùл&ãî A¦ñ¬½¢X5µéfO Åmy{B wÐPÔ54t1 u©F,Ü\?HãÄÄg¤¡Ã ã í»ûë a¯ÆaEX.>ñQ9V m8ÀgÄÊN fÇCO¹taâ8Öð§y¸9Ö:K£ho¦N¹1>NSk¡À ^;Ë Ì׶7Ðsq&!¥ly©G=Ȧ,ÞüNMS}`FáÉÞ$NgGãÂf;ñ¹T®§Ì · #g Pé¤7Ðèt©/}Ú9ÒRA.Á«kÏrïµþ¥ ¿Û£ 6àÍLÏ ½3n4j@ VÑ2ÑýÃmL sH@Ó`ªe½1Ú§ã·Ô±<^!aö»Çõ@&kR Ýeqt uÿÚ ©¼Å· ×Ýðz ¥¢àu¿ªawdÒøCÉþ&!ôý@6ßMí[T¬D #ÄÅ¥KUÅ;Ð×âBò´fbTÙ5ÚþÂj¼·KÞMÈÖáõc©A Ó*OÙmW°úÁ²Q*C븥iÅñdªýRq¸aÆ%Ñâò Y´Mͤ¶FÚóð÷IÄ£%ÍPQæbàwùZæãCd'Щu2ñÿ B| ~?] ÷ùÿ <ÿÄ ( !1AQð aq¡±Á0ÑáñÿÚ ?ÿ Ø)Oe®zã㯳,_ÏUmù- ~#Z*+%À9õ¿ ϾÏNqo,h ]ïëÉce0ELîûÔ·^S¯ÌøQPÔ¸<_YÙ<TBLÅàþüøçPú´aæQh!ÉÓ ®&9Ñá©Öü÷ß¾`]D¢â0ú´Ðjb®ÉYzCÍÆbßÖæ)Qúãñ<¼Ó=ñë3sÞûô\Fûâ 1UÒG=bs ùI ôÖ¾ø'ÖuE/Á¤&rà qññ.Xâ©Éï[eã±Wí¦Dà I{uZ76µ¤"°+½âô¯û¿â;ø4ÌÇeïÙ¯#Pjá/¾øûEüWñõæêV×HpÊ?Á6Ô^h8vþ~~¥¯Lýw¾Ø_Ìæ3u_ÜG߶¢ ¼ê:FIW¨*¹¾ß´3¡Å±ÌñÁ)Ý_ÌO{'¼³Åm7e È©òÚW¸dêd h¬þ%ée`h¤míWîzCU(Äòì·£öK¨&Ïxj¹ÔÈzLßj]³L«m]ÿ ÏMBË¿©|á¯Wý~E9<øÆð~Á,Tȳ¶pD: WÐxFDë_°9. kÉÿÄ ( !1AQqð a¡±ÁÑáñ0ÿÚ ?´4à-Í«ß¡ p3lm| |G«YR¥{yW¿{ðvü`¸1à k)£*:pêó§ veË . f·wó ÑÁ£o -2ýqKåÅÊXó%Ô6me¬#BÙóç½ae¥jð=PÞiß}`¸àÍJ:Fé4`áÙù×￨¥M\zÍm6 b°õCÉËàZË.X9tÌ 9|CQÒ¼ÝóÔÇ(x8`W¬sÿ %FÎaª9ý09F~Ê ÿ Q²g ¡8#TÉD°ß¾rý½ oSN×\|Áó0ysrëûìÕóý ´fdjãÓ»»¶fºûi [T Å]!½æO ¤ÓÂB áÒhÆÏ=}óE^¦Ðª%{GëßÜC飪ÿ ÚvõÓêÁ4*ù+î«óýNøĸSüµí´ú°B õJÓÏxïÞv½»ÞóÇ¿ì\«ñß}!pV+X)WÞ`V Æ· *ºÍÖþ#/ò9-Ü÷¤¯!ué5m°ôo( õLÓÞ; ßTX±dÖ< ^" zX÷?®ôÐ WÎß©GÌúG3â éöE=cë¬#ª][TðJbÈ%ìJEErC/Ô°<å C0ÛÊTêK"¶¼õ» (síYà*"®~?r¦VË0V&Sx@Ëxß ªzüDvÙ¨A4ðÿ ÿÄ & !1AQaq¡ð±ÁÑáñÿÚ ?P®:PRÀ0{sÞ7IæUáz9Ü6êÐáÀve8Ö@0 cÏ}tÃ(騲ðÏ ~°ä]å|¹= àCU¡B ¿×s6hÑ[9åß÷Ë°ø± ox- °Ú|gX «B f°äÒbUÏ(ZáË ù~=Ø£é¯y¦ø´ýx ¬'Ð hàÚ=®¹È×}*¯hRq ÊÔ§Z#Eº5NÓ!UÑíÎ³ï£ 4¿ ^r8ÃÍ¡@ÿ ÒyW^×}×y1]5O¼5ClKa|^2¥¦(ìòzêOä~ò<#\fÈ:iw8êrzÎ6[º'Ý×Î>LSNÌCmfàÂB·T³N¾$m-P5ZR¿, @<cÃxi wçé,T@B®èraIÌk8&ÍÇçê;àRKñúé§4C¥e㨽'.P \hñãY!¬ï ùaßãñ¹ÿ X'qëçÄ Õºuæ|Ls!L´«[U½róÝÁ³=Ù¡}äöÁÑSæYÇûÒ*;PùùÉÙÍKõJ\ÅDèt8@½ªùÊÙr'«3Vä7ÚM&%Àk½@ ©F.0üÆs|â£ÖOO L Çò «Ë@rX =êäò°¸B¼8ã±/&+ªÏ qç§Àñò¡/.µ@<~4`ñÓñÛðµ? 1 s. wê@" ®÷%j¤ G9pä1¦[¦¢ZO<@XN×Îîi×Ö>&N¯U´XJ®·®,¯N ÖSfQ˨N¯Æ µ(åx mÒMÌ@Q ÍïÆh¬qq+Xõɨ Ü«Ú¡N<¹úêÒ=-¼¼µÀ¡ÄwxÐ ¤¯-äíªjÞlÀ¶ygççy0ÖðDÁ Ïòg#ðãøQ¸4ÖHÄ:YjݽíÊn-_Ö)°mAèßU÷@Ä ¶<(S\3_dðcYI(J~BÁTEjÿ ¿»Î{£6ßxtaÒ_ÜÂÙ¬ pïY¨ 0¸ú`,·Û p_oæ» h z ¼1cáÀ3ßÎ,æ`B¿²QgÐýfõ_,1¤¾»SÀâütl qÍpæ$ß»Zíû`p7ÞnôaÇÏãøT÷ø¦eñù F»¤].µîsÑL(ÑëÆGtÄfDo¤KÁL5hb¼ãî¹¹Úð ÍÌ1Aw67Èøý³O"xËr<ÿ bB#3Æïs j V þøÖñd7ºÑ̦ìÁà1Å<ç¬÷`_y]¢GºÞ5"!" ZêYã ]ºÐé'Nwy⯠*° £ ÜøÁ+Î =§àh8£pi¬uüþ{Àdz§¦aj4Òy× ðs¢Ç\ñ¯.RûÁ9 ?LÙlÞ¯3ûþ1Ó,$áçT!µB6U <ÆOOáÐâ ·ÏÃÉÜGÇ ÃÏ«0K1$ÅWqó¾³bVÕò\ZL7pÎ*kÆ=¼ÇCüò1VÈv¾4sæ~æ¢IÝC®?WÂ4`, àøǤÅJe°GqïY L' 3>f. sA¾ç÷XÔxàF¡ä»<P{@øsÁÎd5TBEjW]k4u/YT!À¦x|Ë£µÉµ*KV¾ûÍXÉËS jí«½)¶Sa?oî¸þðÙ¸æ¼ÌÒkÕP«:Ør+ÀÄV@ä-vh6³XyCnX ? 5LiòÄáïX G é® ¥JºÂÍà¤À/Æ yöC}5 kç²A¤h]3%ýÏàÛ¬F!R _ïXÐÀ4+ÐfÚ£æT#áÊa ¤{kü¯ pÜ¢ÞI1AYc ÁU×k;ÇE H íî wÆÜ >Îð!µæ à¡1X¤¿Þ3Ïlqfn¦ÀßÏM©ªÙÄÐ_X(BwüíßxxÃöÎ,teózÀ<8;ÃØf)ÁúÂ}|ñ¹Á·[Âf Ey6ëÚëÈ" MPV¸yÄ$¦ ñ@ ÂÚrHxÔì$*!í º|1<A!|kË«±ÀºÑ1SÏ 8 ɾ2²_xx[úĦ=§#Màt0"( mzñ[ ®ú¿ï ©Èì9þCôýä ®r bh®N-;"Æy7¥å¿îïXj»Q¿£àwX {poi¬2 qøpÇæ}ä´S¢ñ^°£ ,(Ũïr 7 ó{±ÚxÁaÁ%Ù¦|Æ=Eº¥¨1ì6©½ñy)³ßÙ¤Îw\®Íål@x3cüZ"½LYuMmÑ)&ÆÔ\§";rT ÂñÁ}Ì r ¸D¥wûK¾ù·ýÑíÊRÏ' D}å rç`~ðùÄ(,gUùrÆT¦ À«ðÊa- ®86:yç_µaIôj!¢Ã @½ØHòÊ#E §e6;0dñ"µ !ÀMMï¯9¬ ષ¾£ÁLâæ¡ìËlç½9ì ²Yû 1\ÆÊ;ÄÒT?Iº HÂ4 Øv^C+I*C1v¼ó´¥ *$ ÙÆ *È=ª/LKQv+uîçÛ¨ìÉ8ëQÝæÒ1ÍUÝg¾¾8éeGã8£¢àNwGç ì¥øƳm]9Þü°0Æ;¸ tj£ªÔîMr9`J;éýç0°é|cRDÐ;r¥aÐÂË{TªÛÀ¯bÚ¸ªíýùÅRôC1» è8JrÁz·|+;.¸®|dã ]æëÃ;¼±!ñÆ+mBfPèîüÿ ¹¢A§h/°'º¬ÚkÐòb&wqs]ÀLîàÙïX ¼ «d½¬Ö9\%Ô??Xm<ÉãFu Î[na/ÆñNP ±!ìEô°Ý,¨ %8äbþ©sãç@¡i×TIÃ@XZѹ»º]#Î 4 v # ',F UÇ H"y"ο EEÒO3¾m$ Ð8'õÉ2ëÖùqÓ~Y¸~ð8v!ÿ óÎM,Ðß 6 ñúh !H£Òïno¤få7¢l7Ö-Þ¾¼ÿ ×Îk0Ö)¬ ÙúÎ×; ÖQ¯CÈ·Wð°ÔNÖõxò]c¡ÁË ¢ÑtÄøDONw´çl"s\ð] ®±w3%ÐÉÒ'§ n:JPúPvì½UgÅ#ß¾ X :$UwM$â Lî &§»¡ô hf×A¾\W´ 9 Ò ¹õµdR©U{\¼ M µñDÒ#E*9 ÊÑD®ûÔ¸ iÿ ì÷RÕU¼ÝóiÆ°Î0¹w C¬4 a¢à ü&pç7Çç·ãOÃ@é1*°ÖQ:6ðp£¬#N4Ù¾üq8Áe`°Ðm` \¦ ¨Xä0GËØRÆû?o mþMæÓ¥ßNjoF§¨Þ7|5ÌGe-G0 ½ñ¬Ôè Uµv¼Ð !³m`l?Êb#cÐÙÇî²mAà4{VëDjBF¶úÈ_/8'XZûÁǼÿ àú³ùb,p\Q ÀÐqðñ|¿sð\<~x8Ænä\QcÏ9Q[ßýþܨ< E"SQ©÷aá@5Xj Åçf ¸¨: ÐsÁkLw PZ ®õÅ ,ÝAÓ¦@ØEUÆã+µBN« Ðu OÀ½`kX8$Áã8ÿ u#÷ËÏ7¼O9×öÉéã?S; Ëéç,õJe´ó7Ç4ñ&6£ë]uûX¦Ï?ß÷,Ü©7M;a|¸: B¼®ÕUbR ïk}84JS ó:~Þ¡¢VÆɾËGAÊp^y ê`$`é ( iux $l!8 ¢ atéMè¢=ØK¹Ñ Æi*MB2õ5&¦ÅäRHh£ºÉú©±#Vv-Ò)¯ëmÞ°PJ-¥ËBrí¶èÐNX1 ÿ _¼H]iPÉðGZ]SùÇ0zØiÝÒwàÑ~hºÑ«;>g9Ôí @TÞºS~hô@ÄÝçw]Fò$ÏtÕ> Ýx ñç@VppÚ;¼³õ{Â[> Tb<òs¦/3ª¿ ;×Å˯(÷¿Ýªæë¨ðØA"ëbO?§/?^·øû<à7ä6°?ja´DóÀþ3`&óögÀ¾°p¦ \#ElÁt}þÌ 8 ØÊ:ÓöL Ù(èdä_@¥º>æ²@¢Tyª´QÜíó A+µy»µÑÍÆËIü yôå DGpéz_óÞ÷âÊODå¿Æ"7 #C0ðpÝ&3¬ { Ä9×®jLª ©4Zhxy Ù÷óíH,<Ãn®¯Ì>À*%3H/Hßt?¬¤ sÉb°ð¦ñ±=\P ÿ ÕÁÃÓu+NA²5²G*¥ ]ôT&;Jèy& 5. ¥A çç¬:'`¾Õ d¤À6kÉýe# ¥ §{øãR 0wiG®nظ¨426 EïR½ Ú(û {Pì@ ¦°ÓQ ¡YÁAû1iAJóS©¯=î0kh*ò>¾yþìY6: O¸$ N§+ØÍwrÅkÜ9'ë ¹f¡A%õ¬SFËä?æ,ªð¨»£ûßxÛýófÑÙìv#A)f¼õ¯ÎC0 ±ó°úËÂQ¨²Î B˼êf$>±ÙWfõ¼ï\:¾s9ÍðÍ°?xVùÀ¾\sëÒ{ÁÉè0I¢d¿@|0Uw^s6ÕZ¼óéºÝµXâþÕÛã}ê \AùDlâpvÒ0 °ìíMýa KX BÑ>$¼ [ÐÛËÙ ¥ 9Æb6£öß/§Æ$8B¸ixt { ê«và x0J¡;;| y0{Õxï 99,WÖ*ZÎÊlá»×Ky'ýfVût:?\ Þd#}öuÎmÀ G0 ,X 2bõ5AØ;{ø×ïX<Æϧü·@`ð`$ó;áÀ,{s±ÎçÐ0wà½á_õ}`óñ e>4}Bñ¨3èÐU@tEÐYýÝmI}ùÁâ=ÝHm HÀ1òÄ ¤Sm¦Õ4kÉ`^4 ~°ËÖ=þÉR"+8¦¡@(åxÄuHÙÓëG8Þü óÕ¡¸Ô£78ß'xÀC»Þùÿ _XX»ûÃ198¡xJsLh !èþÿ <`[æÍÄüE_Õ=]ïÛÞh5Hÿ 8hõ Ç1_p|gg ]¹G| ùb-`ðO ðFÑî}dç4cTg8§T-jÞyjqö .µ¼4¢6FÎ9ýf¥v¼¯xÀL°¼éßêjåm1ªÝÝ¥Õ^/É7Çëj @ ûk¦ó Í3h$GV¼#z '÷ÆP³A÷=fÆÃ÷èTxf ¢u³§àìáÀáh@W\ ñL Ò±ÏÑ ôÂNu'f:1Ñß8(úüS0 Öà{ÄÒÔ<RAõÉÙáƨ軨¥ò ]%m È =` ¼Ñÿ ]äUÞDÞ=|+2 3tÙiÏغÒVÓj·Nþr] Ê ª ul%Ã,~K2¼G< w.ç'¼5é?Þÿ y³UÊÀz=â¦T%' p¿x/b(µ´gòg]Hü)P×Kå)ÿ p¢¡¨ú %×ß<cÀ-iaRÈ:áÞ ûÂ㧠&<p|þ@¬ü ᬠÃ!¿CËï$53èÊ¥ÑYÃ~ ú&hæÙà.mÖ:B,½½òäÖÊvÕ÷¿åÎ8´Òüõ qz½7#E¢é¶ õ¸Ø$Gûç çÑËI¸{eë^pDu@=â³ç o¾Þ0 !7>± Ã}ÃèŧÜt çMÑù"D@DDËÚxãvQcH)ºðèãÈøضÁzÞ°³ Ñ2»ìÅJ`Ðàëða5³5·XÏN¸ §÷ï àÈð!!ÏbG ¬ÐH 60j ï{þ;ÃL¯0 ÷ëö[ÂNFq(w¹,D¬ Ãüå?yN 6'#ëUÛ²$¼¾tÍñÍT _ï<lË 8( ïúÄ<ϬnãéÌÔWR2½¿\Ð?Xu«4¼"ÔIKp± Bhõ®Ânö<?§Si >5ÞðüëgQ Ìr~?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14228 |
| Response Body - size: 14,228 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ùóN÷¨Ãp` h5MM À ÀO ðÐ0Ð3á `C ÌÐy&£ ¦è(À(À(À) ðÔÒy0Ðxn¸áJ<üÅQ\ MM `jxnµÚXà½(*+b:ÇB°Ý Ýê~|«<N5s:§È:ÇUr é+òó´°âóÕ?iÎk½ ëÓ²cÛLñN8FÚÖsã\®=b³7ÉJú »¥ÕÊòÏçéÞ âì9 ÐqXu!ID[czιer6´qc=È´:7¿#Ùѹ*%Asíà§6b*çW8u½¼© 1:çºr7CICZUÒwN½eo"Ì·.Y`ÉÛ ù%×Ëï;ZÐÕÊÕ¬ªg ó³hë49¯×ºi_G¯£ëJÍ¥Q«MzÇ.ÎH÷¤©]üÍÔ1)*ÙAÓO¾7µâäç|§Ô|Õó6{Ü<ÝÍñÅÚ=)*Y¯:Yɪ¶Çò¾GWçö~+G¿YÒ5zæyÐ^T·×F ¼_ÂÉÍù¿øµçêôùkÏRRtÏèÝæò®øg&ÔÙµ@çå%°Ëfûϼ¥zm~G]nJ¾aC+ñ4¥Øm«éôìJÅåôf*¶ (ç DW¡ÜWwIͽòÊÈ%a1×LI«vwX]ÊÎC£ xj$ç¶å«L±ubÍÒÅo:ºcÊF¥¼¤&Bz (ßNf{yM*éë+ήYÍaE}²}ÃÃÐ ºµ_3úë$hlR;é~^bçÖttstvKÉñjª*Ãsjj¿¯Ë<RxtCcQ:gç|ò¯ ¤¯%p@ÈutÀ5\lüijUSÕEÅ6Ì`²=;ÌK ¶JJç8Xê¤té¦ÂèS£åë,M³}iÍÚO2 0z``=ÌLÓé´À4À7 Ea@a@qFM³î ÜP ð Ì ) ÿ ÿÄ * ! "120#@BA`pÿÚ ÿ Í+ù8<BþJuZü¿V T¯0µ+d-ÈX`) ^uBã\Q) nµà ÙÉj¨WP#xã©¥Åö ãì °<{e#¾æFc;Èç[v+ÝÂhqo ª«e ÓS.CÔ>±þþèáj'U:N®Ç?SábÑ"Gdö²HɲäÎF")¨¿L½í¨Hâ,ë½Àn}ß}¶ ËO¯=¾ãP¸ýËUê]¯ÀDvà @¥N#âGî` °Ù®5¦7榢®Ú²äemÂWµÚÑäÆûWEW°ÀñÉê ÿ .q¬®ü!*¤JÐ%Xú·´ã¢ ¬S¤ öQì8¼+ ¶â5*(Ý´`Ü®è9 îÂPJº"@Àv»/)Öõ N£.Cøî«æ¶ nû.TAò_Èul2cêr£`Ëóbcìa=Áqp]u¹þ ©Ê_¢ê~tb# ÞÙj!b¿ÀÙ:vVFüN#1öjºî ûúÊ~CEÍedC ¥ªWE7=Î?Ëb.[ãTàé¾Eäj0¯ _U¸ ÜáÊ9( ëu°ÛV!Dn\U cÑÖõä¢=hû j] mòE¦cz¢Àp¡@ E{,Æÿ "ÜK¾Eå`Î_Ô$v¸[|µrü]®êþ5ÈáC4&z[µÎfï¸Ö\±ØÜ'# =ÄQ v±ÀlØDÔøÚ¸þåéÎÉäÐʺ'°ûâ ÷ ©R£¥{K2AìµêGp U/²þ· svâüQÇÝHnËí2®QÖ0̸çÈÃbøïúN« K?Ø_P!ñ¸}Â{8fÆÅaxíá÷ NW ´ 1Û5ø¤_î%LmÆrÓj îvZ¼WéÇdútÎPd3W@yÜcÉ/W9 0f.à 9K^Dù?r=§û¡41G±c\¿ÅûÐþ g)v j\¿ûßÿÄ / !1"A Qa#Bqð02¡ÿÚ ?¿u«WíµjÕ«÷Zµ~ËVZµjÕ«VZ´\Áºl¡ÂÂZ´\ÖßÙC_ÊõQVíZµ6@ Ç<´7ÏótÜ°åê¨Ó ûQd Jy ÷ÚÈ}ð¢Ê2>5ïb*ÇËÖ7Z\Ó¥ÌhÎõ3Úý~·B|®¤±¹£ý¨r(°@M1{¼)È#Kê!7Wu64¼øþ}V©"qul¥ÆÑÝ#Xß×Ô¤¦Ì ¹äð£ÆgW°~èÀÐ8Y )ËOMü©5´®°s÷;'æýEG5I<©atG\i³ º5(§Ú.L À3´ìÐQËû§Üëg*Ièß]mj Èe³ÂüE¤B9Ñ *W2A²cÁ^´ZĸìW®Ðâý'æ´rÊcü©¶îb$r£ÊÝbËmíÙGñæHç ©Ï*~ ·Pkáe61 ßá`]nf¡ªfÄçè¡d] ¾ wÙcùåH<©ºcûJÙÒî[XÖ#u©DÖiíR Áºö´) ³J,KÝC,ÒÔÜ4näì6ù*H£lÑ59zMÖ xMÄ{çVÿ /(á°sº t°n¥É Tx= x³äìiO/SeYÒÎTXÚSX Ä&C[y 9Ø%¦#(!OÖþê8L§¨õ3;Ú@kÒ|ªÐ/õ Í´÷ ¦È.:#å3 @û¨¢ê¨¢í×ôåFD/Óà«T8Í-*`è$j*);£}¹ n»V> hYQ<&ÉîYÒle æî¿2Rßú Æ6j²W4©GK½ »§çt|© 4Î1ªTm;¥6&ÄÂ¥H²Ô!×÷Qc@ð¤iA©R©¿ÑºO®ÝÂôÎsµ<¦ÄDz*Uó¥J*T©iT©R¯xT«úóÿÄ $ !1A QPa"ÿÚ ?ýUWùQ³ÁEp²3í} è¢c-*Þ(¡éþÉÉÚÑ|] ú2(¡ª:èlLNÊ1 N:2Ó$ElzÑÇ´bCb%C0© «,?Éé\ýÒFÄ*òO SÌxli ©ÉBÑé%/p´;±phÆôB mfBt&w¶{JÆü$YÙÇì#Oe£%ÅdV»,LËCØÐeC߲űi³h²ÈðSmbÇÞ¸²Ç´-öEJÚ} oáfEÍÊQ þ§ÿÄ 6 !1A "Qaq02¡B±ÁÑáðb#@R`pñÿÚ ?ÿ ؤþ^÷+ }Ô½üÕá²²LàªÜg#1îLp÷¢¨ Ý.Ôd À*÷¦J³kâ$ ¤G ªö|µW8CÙÄi 'Ôê¡¡P0¾ájcD6nwS¬ñÍÕ(tÝi¼f8±åImà¡Òµ`i!®PuäéP¨;²Çf6dµß¿öT-øG©íò ÝDdÆU¶%Ð:X o~Ïõâk¬Ð¸«" h[}¥ F §1'ÐÉ.YÑYu}wqk}× úöF⨡ 7¿ºbQ÷Äc~CC{aNò¯×wF;©Eĺ0«6 ¦ñ27exV~ÑÍ »£0 ê'wV$ ºa ÁЩ@hUºµ*+$£S<ÀE.®N/;³òÞ8u¹S"¹ÝYÜKt$,FêXæ ºÌèOci¢ú}lh¼¯^ë¿9Í"QÑN0L ÕªµÙe_$ ¨'^ è6ã=&Áì @wâòÅ«¿.ß}>K+¦f>,xdOä²¾|ÕºLöÊ;7üQmÇmM§ÓõNë#EÂÖôB1Ù|.twD\M!=¢í'IRèÕ_<-¶öeî=ÝD;ººX(ÈÕï¶p« ¨jwN«£¦4Óè2Fª6} aaoÌ"\óüE»gïâFe&'Ç)о"ÏÏi³sL0~H3dû ê§Ã¬yAÂ">ë_E$åïr´AN¡þ+ýÆbê .$ßáqÊl¦æ\ªôVPêE Dá §ê¤m ´ád@ Åí84?%®´£ °È=T}UméiÛB ZëÙ\,Sv]q~ª Y^` ×HMcõ\@½ÜÕ ú®<X(¹ÏëáÃ'ÍJ¾YÁÒ4ZÉ6F+Oo Ey)Ìiù \O¦[¥ÿ ú;U®V~¡tºá\$v_¢z z@4Ï_²0>9³»²ü$ùV@]B) ~ÈÍÍ '¿T¤áqXnÃg§M 0z³góC¦5R pÂ5ß>P1 Ý5ïÉ0=ïªiu VÞÙË÷ª¹¿Ë²Ð ʳ~¨Hú# 4Ö0@ ýZÈ! ªÅÖJ.3Õ PV« < ÝZÒ̯åz##*¸FëÂ*ÓÌód æ wdÎT,Ȫ_åÍ"ûÅ£éÞ#¾àayWÈfȸ]C;ó?¢µ#Uä'5ÂCIð´ÞâFï²t]¼ªådÙê«|» [¸x´Ç³hÝÀfàyC"+%qí ÂÙBh(1w* v9ü·¸ÉÐwO`lEü¿°«â@pî¸rP{H{¿Âhu,ÇHÝEJÙµñ/1Ûûü©dp_² åµä®W_4@ÿ o:¡ÕõNvª2±Ë êFW+fó<Lù©Ä(n9p*÷8[?i'ÌJ/¢qÚ7h')£Ã«ðêµ×ÜdOw}á:Èâ ÓjU¢oÓÜD8²x9n«ÑACöWÿ Ô ÷ ÉP1ÿ ÿÄ * !1AQaqð¡±Ñ Á0áñP@ÿÚ ?!ÿ Jÿ Ë©R¿ójWþ]J*Wñ©_Æ¥Jü*T¯ðT¨°ÈÊÿ \âë½3[u¨À<2¥JúWòÑÍQþ2Iïqt¥\©n¾*T¨Ò-æ2Ýn@E !Ü}~ÐpèÅU¯:(±Í1¤¯âiwÝâ·UèmjúØ4ÿ UãåUhôÈàhN¬`û ¤b¥ ¨Æk ýDÝÙk× >©z#eÖ ¶Ñ®Lÿ ¦8£JéÇ_^Î â8{{þ¥$ª³¦"¨ÒrT¯àdËA{Ä´ãí0§ R© l¾3K¸]yMú|¹ÚMÏÞU í¥°7\iÒ¡¯Ü©R¾·è½Ä -:~}⣰ÂXò«Q18NõæjV½²] !ÇÎÜjdPÞu]\Ï8öAtk[+Ì¡©R¡LÐqurÃÉÓè .ªþu%9ÃZØY¬g1YÔ«þ]~Ù¹mîÿ ¯l0 ðatýµÐmªéį LµÄb¦l\Q= -Ûbç xÜ XÇlÅÄ- ~zÎÓ_Äy*üEÐ]ï¢}@ØÕ.ëþÿ ©) k¸?E#élü;DÎñ~¼¼Ü`9§ þ¥Ø!ÕûÚN½5¾h i²µí<'T@óÓ S úå(¤g´s§Ü®Û=Ò!gN¥<ú½±ÁYqÅCkAà'^%@5t^¿oêdÊó%è¬ ØJí Pê×Ypa [[ÃQ+T¹ÅâÏù ÜßIP#Kv¼wñÇ=åLcCUÞPâþçá"ö+¨,¸1CL¼øv1ÚTåߧ¼`f`P·dNeÑ*6g¿F/0É®eµuséùûtERÐ6;õûcÚ òTXÈù°)ÖfëÒ¥âë ¶+äý}D!Õ*& ⣦X<>lí¹Bp¥6Ðï¯6ú%P)mà7ÕÜ4'\tF£´²¬Ë¥;Kà1õàB F[ Óì¦Y%!Y~ó7_luíä`Ug'>Ó^WgîþÑ¢ÿ æ(gÐ!±N· zíÏbvýLJ@Í_}@ÙTlEìTjdn J5=u/4x(C}>°T«ikeà}}%tâ]{MK{J() bI6 k¿Æ"gÐóý0§4éÀuþã|-*¯Üºùä,Ö£5«iJ#7Wn}æZô4ÊåR¬¹ºûMF¥ik²Îæ2u2f £\í¨ÄÎ5gnÿ Ü AêJ¶K`v׸ÁKµ¾9ô;þG B©Tx h'Ëé ¨ÓZÌ ©ÂáÅu õéħ»©W^OF¢ áÓ JÆ0e ¦^MGªëÞYß\T~o.E¹ ¯(¬ ?®?¹vÔ8»^·/4_-ã}³~зºÊMôcêóþÍB¦Îò)Ì©ãb´*è }içæ%ìi ª9âPb.]g½å °2'V¶(þ¢[®ÐhqÀínÈVW6¸¬ÝÆ[¼Þ𰤻 B/X, ù ±OäùQ@oW¶%âÔsùj$l'àa?·Y&|G,-õ{1tÕauÇ<ÍQT»ÓßSlMq{Ù̵`Áiw¶Ìçá.zÕ³goí_Q^ïâ×@»´8WLÕKºÞsInï-ÂõVìu2â ª mÛX ×:ÛÉÿ %Ìa.4\0GxÄ¡/æ'%L _ŵxjÏÉò¥Vó¬ ¸¨à¯aI1ýÄlvÎíªOÑ`Æo:Ë. Ê ÃXver¶Åñ17G :üâ°5~ -Æûs5£±¡8m=ëïCnºµ3ÄÖ®|Kn`BÑn8 2¢Ú/båHÑWyô={ARòjvÂF¨£GGYÞîßJ0 YV®îzvçÕ_C®ÓÃõ. ¡ ³°Ëåoç¼%àñÛ÷ T;Jk3HÅÏ ´|ÅNùc"{?D$]ȺVN°áiA} n{Wö[ëÞXK_¾ãgÐ;{¹+æ '¬ÒÞk2/\ 7->Ç1e®V÷Zéjê¯akãYîË>ah ôV /XÙY- W|<ôªÕTâá×¼=g>´±³u²ÔníçþÊ2£W{µj±fú~³0.\JT~ã××Æ%JÁº% ¯ ¢ðë¼qûld=1ªõéSÛð¾Ëvz}¦kG¨~¹a`áÈb°t WCj qçpC¡«ôçuûP=ÃY OÌAl±´(S^´ñ_:Ô°*¸"¢«Z kïU\óCuN °Æ 44ö<Ek¹] t[w >0SL{·ÐÆà¿!Ù|óFÁ×ÂZº½\öéë1HwÝ ÃÝ¿äçTýa©@ÖcR)®ÚßYkzªyû@+Ch 7îÎBJ¿yA_Ü®Æ8 cµwNfÕ¯¬¼¸D¥ès (C$߶Ù)GÒ³-(R9yélr¿ÌÇ1Í[ â2³A2Û´[n ½?pfà9u*xÖfJ7Ý*¿«WR^·õÍHUbúêh «7Û8×?@ªMd²ÊéÆQ6äý0vV&Q9þÔº¢ÆAÁëâ¹íSLÖk9+Æ\Ëm óÇ51dgn¥Ê.®ÔÔ# 쫯=4Ã/:õ~òý!l¦ï¦®2 Õï>¾Ó2ZÕ[;T¸3Ùº[ð6 #Ìáª4¯É¬Æo¦æ%KCP". dÑå¢X·â#f ¶ nìëÛo·Ð Ý7·-^"Ñ4ºQ¨©«FºJ î·ø ĹrÖÞ§Dðcn½£Z9éPXneErÕ·ún`ì?}CÂñEÈíãoH©[Xí-f ¼fhï85Õ!ñ¸¿A2ø]wú)iªï¨Ëoôf`®\þþ\ÂXÈRè%öçb>×55XçÏhêÊËizXeÐfPÒë;ú*4y,áÔÐ|Ó£Í{%gIìô..òùþáFKP-RðCæß¿Î"ÿ 8F3Qäém{N_§é\s«Èðß´C6 C] ÙüG>B Le¨EE¼¶é©Jÿ ³kóÚ`&wA!tÉ]AZ2ãzñ/ òrÔÜf¶9}IºVa>° QåýU²Çøë(5[huíÓñì.ñÛP4TèRòUl¨¢öÕñ\õí¢x ÙýD![r+ù :íz±R :Û¨!±¦=h¿K/éCc#7bGÊta¤îta8m,ÌÏX5IÆ2T P4bXËþ56LX±F¯`Ác¤"{ÿ ¨»Jê à¿O¶JNZÇîdZèô¥ói³Ù¹z¨·õ¹Êåÿ ãA A@b\¿ðÐÜnÝhloo¡ðbåúÇÿ ¹råÿ ;ÿ Õrÿ ð.\¹ü¿ÿÚ ïo¾úÛ{û?}÷Ã8 ,¡Clþë<{>÷û>ýì/GbJ1RÉ^[Þ¬ç.¢8zE¤¸U(~l3 ¹<yk¬6(þÖÀ°ÎªCõ þòPòE<ô¤nQøNí¦Í% ènjvµH ëÔA)Ïk¡D>r@3¼{üM o fßó ÆsÙþMTÛëì$F²6 1ÛÎ?ûÕæãþçø/¾ûï¼~'}÷ß}÷à@ÿÄ ' !1AQaqð¡Ñá ±ÁñÿÚ ?øD$cða Ò±?czV1èâA¢7¥bE ÐcDÜÀ(_ðC ÄÏ©}ý F ¢ öÚXj=&@VæѵÞXÿ m] b2Úº/Ö×ϵ[AX`¨Ä¶õ?b:ÂY¦vǶeçµGÞIÐ[ s+I¥hÖÌÀð Ð!9®'<ê°à`P@BJ\^ÂÍ =±{;ï^`²í¦÷$eS bÙzûRàÎkó¦`7*KïEÈ;C¬B{Ö'++PÐ6~ QG6¢,1Úä 6CH2ú ¦lÝ{ñ¥!U¾÷¢ ÚV¨"Ûq¤è|ubµþD&Ö§Ü ¨Ãw ¾ðj¼v~*q$.Äõ© × C²4ÉÓ¤QÄ Á{1.!-yú jû¸Ô*4'o?Ø%Ñö¾GxÄ@ñ ø¨1,ò;~¦@ §ÂÅ ó^Т%Õ·R?Nêþàh|óª¡ ®aÀw( àfHÒÙL¡ ¶é³Ä4"N»>qâÚÝ> Ö (^Û/Ôº k9%p ã \CL v¼1Z?M/vöµ íÐ º*ýÍ8²ãÐÔAÁ¡>b,«öîVv«D ¨´ÏEDn#¹?¨/>w3.Ã+ÿ CåTo ¯Ø+¤ ° ]{} 'Ô At æ äßÜ õ BÕÅèhzãXZ µEzBÔówÄÌy ål Æ`ÀTøþðñýÎñI =ĮɩqJuƺ^~icµ"2ùLkp+UÝÞyH64+ÇøÇ(é Æ Ã±Û¥Jæ:8Ô èºvÜkK×ø`¡h4ä}[CY µ åFô¤0aÞ[y¶£d&¥sFë°Ei ³Úâ³®6:ppÎ i +ÁðG ³m sDâÿ 1Xó )ðùq ¶ÂÖö?¶J³¯ AZ¦ü¿µw¼=oæ"+DY¢ÎAk÷AKbt¥_FµW¨CþÙVúAÁÀ`E!Áõ7 E»] Ñ(ÑRú-°Å ÚýéW b@T<ê=º½Ñ8@1J$bëï3ï5îå BE»¤¡äÓû T$l _]?p`L£ l(¨¡%®úºB0ÛP²wdì©0 BÞTòòÔõQ£úR!/¬$ D? q"~`8zÿÄ ( !1AðQaq±ÁÑ ¡áñ0ÿÚ ?T!>BT!>B!B Ý %D¸4Ø¡Aâ%^Ïô;ѪÆJ$´~¯êÓ!:1ø iàFÆ2Q§hºä¹lZh µ Ú§F)i§éðko9ÍÉßþñÜxe©[3zøN²'rQÜc¦QàÙÔØn+ÔÔ1 -LcÏAªwI½1s®E<H4&×nÿ ßATdù%îm¼SÑb¶ÝO.ò c·^£bÄıä2;«:gÙþ qäI¾÷ÜDÑYün9Íç¨ûÖíç7Mø¼÷)h;î%¡/Æ·®üÿ u9¾âzó Pv(Ýkø ®Üè5jË~Onù!og»ÇãöÄ:+G¸¥±ÙÑz^`¥EÌú0%* êo¯oèÕ;sðùAÎ{ a Dú¢ ¬ì¼èH» 4¨éy%F¦0¢ yÎu!ZÝÈèÁ.xl2Ezû íS{íð%5öϯìj´Ï\Ü'¥ª?<þóöCI8ääý Bè¨ N¢\g<ËØX³¥( ¹ìnõ)EMZ0бÑJKA4âO÷óÏдRÀׯÑJRøÒ¥)JR¿[)á|ÿÄ ( !1AQaq0 ¡ð±ÁáñÑÿÚ ?þ4b²,Éù&LÉ ûedr>¿dÉü0ÈdÉþXzü+?dþ9&Gü#É#þ#ðû~õõã!ëð¬æö϶FC'ÆOGáXþRà°ÉäÅ;ÈúÄøÉÿ \ô Ñ .Ö`UÐÙÃ?lV'¿Â漀 zE48wÁ¼ÁàMüÎï 2Ê`¢éK§¿ý¦}q(«|ů²°F%Eêt|ëNǪ Nh °Þ³HH¤ ]·M·4ÝO¼s B*Í<~CqL;Éc³@TXksXÉ&+ñ ¬»3?¥¹ÿ ?& -ÃlÐÝX5¹T6(0Ý\ÀfÚKìï½:xÖ¨}\@..¦ÏüLQ6 ǾOXÆ1óGc÷èãí9haâwUv¯7vÐ@¢¨w¡QDßMþ¬ U²èÐÓ^ã ÒÒP(ª¤&â-lK¾ù÷9X²#³÷#ÀʬÈU/úô¾Ë z¶;Ý¡*Q< Ô v0£c ²ÏLÙ1B#P ¼øâ5" ÊÍ ]ò«{ç2ýÆýF{¦;éM08û¾¿Þ8YDp¡ÐaêÛÃϼp4*,TÙµ7×·=ç* Á!k'1¶Ð6Ø êÐRh0ªIAAaw vyZô_ÛâÁÀ¥ôEÉJ1 n & ©Yj°Ò~ º<îqÀFÆB4Mâ²"gÓ¶ð[n.¬å òwí'yUh¢ò.SÌ°µºï>{(ìë3{@J íNMHª¢A|)r:vqé£Ïu `J¦<AÙ¢ÓZöaY°BQ1E/ïÑZÛÙ¦ÙOî dÍÙZ¢ Ý«È%UÍ¡Ý/ÿ ¬ òéð©_¼âéÕ%@T"ZMôôE_y<¦ÁGl¥~Ë,Æ x MIÌ¿NÀÐhóå/XIR=´xîh*L1ÅÐÝÀKCXD¾fåÂV.\ jÒ¦ç·?¼g+é Fî#kT4¾èô_,\4úi þ×Uá½è§]¡Póç»ë2$¡ DÓ~íµg+È*:UavÖ:Q¤vRí¼ò\·M2-¦êPB¨£A 16õδ+SE¾õ«äÁ¬TØÑwSZ®ùÜ08%OU ®©òå nÖÆûáÁ¯ïM :,Ö¨*Î.Iúÿ ®X1{ åãi @ª°ùo΢XîªãV»2fÕ°X¹ß3vTñ@miºXzW¸3kP( ýz%G ¨¬ÒÓÌ>¬|1Üà¾MBHUk{ÂÙØé U~÷¿ï/Ô$¤iÏûÆ?óLÐD/°kŦØ@Þ}æc.lÆdcZ%{Lðé·ñ?é¶" ] Uv¢Ãæ ô8o¢õ·:»ÀÍ5oêú3n æñ¢ÞD:ßúõLtàÕQ¢M×ozÄ 6¢Nº:Ðr1 x¬¦²i04Щ7ÁóÐiðݺ:swÄÛxT¾bô0 XâhkÞu1sðt#³$-`Jm³Â<HLYz`")b1?`üfÞb}WUÔ<{yUz®^Å (K· Ï<×q5H+ лaw¡uß;= }×ç"tD,Ø ¢t~f'<?1òLLHCÆrSf®å&è Ðv{Â\`"JÙ·Í'¿/Ä Î Û j»~ÿ \5 %#É¿Þ.Dìq j¯ö;òÅK4Wðw9ÎÌ8w'¼9ÒÀíF¨Ö$ãc§JIRC9Ê|#çt #.¦ÿ {±49 iÎþµy ÇnAú¿ýÅ7ø ÓK!, JH·ØH¡Bí M /ÛÜê-æ Ý ¥[n f ¨ ÑtÓºL=:¶|=ýåEóA+ôR¿& Y[³þ} OÀ3\'m£E64çÉ³Ï fëfR ©ûC¿'ªuB1 Ð"¾Ç3 Á6`§2Êb°]lÆ&(Ò M/óÎç d^° ªº=ªü· Ý/ÿ 1b ©¤d÷ëçëð\v âM¬©l¢ I´M>ÑðÙÜ¡6 ÇÓý$b@ééj¶öU§\ää|iÑ¡|ôMB>B 'BW¼Cj¶m@ AVÈ¢ºÑÀgѵscÕei Ö^o ät.¸ W{q:&%ò)O$:ïÓÉZd´'M@Í÷J¢9Þsë*S9%þR³¸çø0Z ¾[|Ë»e²ìWt'cIm<"át½Bªµ¤Å³KYcÐö:ÒÁZ¬$q[ÅÖÑA!ãÆÒ X]ì Õ~ÅÕ ð¼ÓÖ«©&p¢ÄkCµZð e²HvݱE$Äø+î|@ðÿ ÀNÛ@ðÆ>cëlG- ÛÉ,£Å4Rï4¤ÝUCoßhñS zÑ4rtâ \9X}k·øUÔº ¯gX»0hõÿ î@òëór@«àw× H4TTè¢MIµÆÃÅvB&èÀYs@t×È@ýÃËÞR<iŠШTÑ]|¸~%-b@ehKk±4. 5 j»µÕ^YJ @7Ñ¿Êg/?daèîæðDÜè+»[5JÐhPiM?Í$4%¡ ±éIÃp,°¡ÁWöûÍá ¯þq sËmb MÎ-6à¾J%¨®Æ«±íÕ4 oÀEKQ h*PèÚ/B°éÔi¶= CCO ´¤_x« /4 SÃ&Ì¡Ó&,ñÛâÜ¢ÀeìÜ ÂúÅRõ¸¸þó´ NTuD¼ëÎû µFÊ7«A´ÚÇTãÃ&®&+ PjwÆå`<¡ÐnÕ(DË h²t¶® hº%)(ïÂ`Bf£~uÝeþÿ ÁU«q1ñs£wµÍ)-Ã]Ä i¡[4ǾM&ì ã Ü jnÈoÓ°¥ ñ0á±Dìm¬VñD+`Æl)EJh\ èrTKg³]óøÍ1ÚSà§öau i { m1 ¾b¡¹vzÝ\0 °ÓfÕ W©/ %ài@:ÏGXT *]¨u0JtÅù Að Ô Ô@CÜù!U>Õç HøüG %³kö¡öã°Õ JCÛú ©hQÄw â½d@MÕßA 6kÉ° ±(@^£´¿Ùíï=ê`2 X`õ²nWe<Ö¢ªhtìIðJùì9¡B¿ûx Ã[Á#²Ú .&9¶¢Jª ¦[ BU'Ö° θD@TÚ}ª ¼^(YeÈè+}¡¬Lêá! °åLqm°ì§V¢](l | jý-$¸b£Âû }âêK&XM]ø:Æl #xÛµÔãtu$T°´ »!ñ 5 ÂÚÐצºà7´ÖÒ.ÕoÊ¿8Bh¨öÀ?Fx1vÐíø:ãh$JD¡mÖ;~µPkI gµµ<´ ÞE.ç ;g© Шvi õÝÝCMÒ¥¿éÆý#í.° ßäCô/éÉeÖPEØAÐÂ9¨nA)TUúpH´j_6B³H P@@Z@< ÓVV¯íÛ¤ ªø2ÅFı,8`UÏ D ð /q àöÙ¸Z VÄw]· Dè>G×ÖE%Í à |ã j*Â&ÕÐãT °Ó×`ýó¾gj»ä®°[M=êÍÌ ñH<ûÂØb5g@ èM«4S`ªðÁ³è¥PZZÖ¦R¨F]Ç{Ð}G7Q)Bíß ÒoSab~ùé¬8ù$Oû¯÷ÑVÕóùEø¯¼E<"¥MBºÍ$Rªô/`¨^ Ö5ð¨ÓPZñ¸÷bºä©Oø pâ _lôaGô@È¡ÙàZ5Á@$Zе¾oª¡ªí×>»GÅÄÊbcÂR)Vü¬Êä{ óB»R D@ª(64E O³¸`4:I@Jè*å;U"@+7Í 08Noh 6¶M÷úG Fè¬DDI}Be4!¬UÁ¸qdFz*÷JÔZò®v:ëÑp@QÁûtëNè *½° ôL7m[ÍØ=Q®;ÚóXR×1Hko]o¬+RS<9ø"äÐÚM @µ©MV¦¦Æø Ȫ1G}!ãÀnmŨ*¥O±õ 4Â+`ìß ¡È ùY$E-QJsN ®5µÃWË©ô~ Î ³YµÚiòöë8$µáàXY^å¦D"U Q³ÅÍ@úMÉÈÞ´ ÖGèõj¡Fê÷í éÀ! P²þ¶ýõ-üÆtd v<×#GXé !ÐG´v\>X T!Wua lêÈnvtÀÙ?ßØãÓLM>Çö`B:=%±<©;¬pÎÔh¿m¨¿T ñ ¾8¢SE³ Ñÿ çXo"¶§ @ -¥ÓÚ ?Bªpu ¾íiÍÙ1 ÃôGk,5 @ Hé0õ´xÅf é9ÿ {Éh¨ÉDÏ>(î&n t~A{÷¬×Çàeè0¥¬Êl¸ T1 ¦êNvîÞMjyl+¼Ù#ºÌ`±P@úÍ åÚÂx î·¯O§è_ X¥gZ®º»û¦1 Ü6ÍîªÁ`ÆÄÖç; \Tܸ pV Ù\# WÁö¨!IáÒ<Ei̱Á<Ss§ßÇ£Á{Ê+kÄ4vÖ;(êØiUgmêTUÙÍMox qÏ+³^VF÷y @ § á,»H;éaßÛW.I3a$¿AwKXOÅ íFìØ _÷Ð|XQ^³mRÀ@PRrg#ÐcànÁãÂjÔ-odP ÑàéZEAH_éý,Ð é6Ci^G,ªÆRCr¼tkTqËó2ÊÓå ú X¢å t)¤)Ùc¤uÜòµU÷«Ì £PºÑlçbë,± ¡c Ýð{À |Ò yÀZ%ÜS"A*{×lØ@ÛáÞ;õàw´W»Êþ. Q(DÄ;¶×¹ºa9ZðB¦Â#£V HÂ`øSÈìX¡Jp««Zp'¾º0=â m¢î íÕ-I Ü×9ïíÏ 7 ëç \¸8$è% öï^z ÜïS&Ë¥znA» 7:G³ YÈÐ ºV»Tú ÔJ-Z8YúÝkÊ-<´4xçëÏr£Õ7 JóÂo ²`j0*¿[õ|ñÿ ó U¯Î#ÞSÞ ÂbXF:Ü]9ECuõuÜÕ=ñfÇÆϺ c¡%ã[ÆÙK©¨0ôA$Ñ'ë 3p Tíò.·IÊbnñÓã$!Õ½CK¨Ôde`ÚzÌBi4Fíßµæ\®\®8ë 5íYú |®ð h¯´NõøÉ";; tmxjùøæ @lGM¾1âûÈϧà&!*8¬O´Q×E 8SíNÑ}[/5xɪó×&85)HÇOiòo4b$nÎëYµC4Wéòw~ DW¸áWò3Ö:E10Uã§|Gab Py´aÞöc Ô? 5<QMÓ ;SOïí< ò±×oUì÷OfÊd [½0ç1ª´ú1Õ]þ)Ê{Êåq~r?ÈS °£ Q )8`$øÖ7ûË/æ¸8å<<pÜ¥8u0RînÎI Ýæ¢á@<âî AOXUËþJeÊåråråË+ü)÷ø®\\§¿ÁX·üéË+üª~üëï+ïü®S.Wùiï#>YY_Íråÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg&size=160 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/5.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 14228 |
| Response Body - size: 14,228 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ùóN÷¨Ãp` h5MM À ÀO ðÐ0Ð3á `C ÌÐy&£ ¦è(À(À(À) ðÔÒy0Ðxn¸áJ<üÅQ\ MM `jxnµÚXà½(*+b:ÇB°Ý Ýê~|«<N5s:§È:ÇUr é+òó´°âóÕ?iÎk½ ëÓ²cÛLñN8FÚÖsã\®=b³7ÉJú »¥ÕÊòÏçéÞ âì9 ÐqXu!ID[czιer6´qc=È´:7¿#Ùѹ*%Asíà§6b*çW8u½¼© 1:çºr7CICZUÒwN½eo"Ì·.Y`ÉÛ ù%×Ëï;ZÐÕÊÕ¬ªg ó³hë49¯×ºi_G¯£ëJÍ¥Q«MzÇ.ÎH÷¤©]üÍÔ1)*ÙAÓO¾7µâäç|§Ô|Õó6{Ü<ÝÍñÅÚ=)*Y¯:Yɪ¶Çò¾GWçö~+G¿YÒ5zæyÐ^T·×F ¼_ÂÉÍù¿øµçêôùkÏRRtÏèÝæò®øg&ÔÙµ@çå%°Ëfûϼ¥zm~G]nJ¾aC+ñ4¥Øm«éôìJÅåôf*¶ (ç DW¡ÜWwIͽòÊÈ%a1×LI«vwX]ÊÎC£ xj$ç¶å«L±ubÍÒÅo:ºcÊF¥¼¤&Bz (ßNf{yM*éë+ήYÍaE}²}ÃÃÐ ºµ_3úë$hlR;é~^bçÖttstvKÉñjª*Ãsjj¿¯Ë<RxtCcQ:gç|ò¯ ¤¯%p@ÈutÀ5\lüijUSÕEÅ6Ì`²=;ÌK ¶JJç8Xê¤té¦ÂèS£åë,M³}iÍÚO2 0z``=ÌLÓé´À4À7 Ea@a@qFM³î ÜP ð Ì ) ÿ ÿÄ * ! "120#@BA`pÿÚ ÿ Í+ù8<BþJuZü¿V T¯0µ+d-ÈX`) ^uBã\Q) nµà ÙÉj¨WP#xã©¥Åö ãì °<{e#¾æFc;Èç[v+ÝÂhqo ª«e ÓS.CÔ>±þþèáj'U:N®Ç?SábÑ"Gdö²HɲäÎF")¨¿L½í¨Hâ,ë½Àn}ß}¶ ËO¯=¾ãP¸ýËUê]¯ÀDvà @¥N#âGî` °Ù®5¦7榢®Ú²äemÂWµÚÑäÆûWEW°ÀñÉê ÿ .q¬®ü!*¤JÐ%Xú·´ã¢ ¬S¤ öQì8¼+ ¶â5*(Ý´`Ü®è9 îÂPJº"@Àv»/)Öõ N£.Cøî«æ¶ nû.TAò_Èul2cêr£`Ëóbcìa=Áqp]u¹þ ©Ê_¢ê~tb# ÞÙj!b¿ÀÙ:vVFüN#1öjºî ûúÊ~CEÍedC ¥ªWE7=Î?Ëb.[ãTàé¾Eäj0¯ _U¸ ÜáÊ9( ëu°ÛV!Dn\U cÑÖõä¢=hû j] mòE¦cz¢Àp¡@ E{,Æÿ "ÜK¾Eå`Î_Ô$v¸[|µrü]®êþ5ÈáC4&z[µÎfï¸Ö\±ØÜ'# =ÄQ v±ÀlØDÔøÚ¸þåéÎÉäÐʺ'°ûâ ÷ ©R£¥{K2AìµêGp U/²þ· svâüQÇÝHnËí2®QÖ0̸çÈÃbøïúN« K?Ø_P!ñ¸}Â{8fÆÅaxíá÷ NW ´ 1Û5ø¤_î%LmÆrÓj îvZ¼WéÇdútÎPd3W@yÜcÉ/W9 0f.à 9K^Dù?r=§û¡41G±c\¿ÅûÐþ g)v j\¿ûßÿÄ / !1"A Qa#Bqð02¡ÿÚ ?¿u«WíµjÕ«÷Zµ~ËVZµjÕ«VZ´\Áºl¡ÂÂZ´\ÖßÙC_ÊõQVíZµ6@ Ç<´7ÏótÜ°åê¨Ó ûQd Jy ÷ÚÈ}ð¢Ê2>5ïb*ÇËÖ7Z\Ó¥ÌhÎõ3Úý~·B|®¤±¹£ý¨r(°@M1{¼)È#Kê!7Wu64¼øþ}V©"qul¥ÆÑÝ#Xß×Ô¤¦Ì ¹äð£ÆgW°~èÀÐ8Y )ËOMü©5´®°s÷;'æýEG5I<©atG\i³ º5(§Ú.L À3´ìÐQËû§Üëg*Ièß]mj Èe³ÂüE¤B9Ñ *W2A²cÁ^´ZĸìW®Ðâý'æ´rÊcü©¶îb$r£ÊÝbËmíÙGñæHç ©Ï*~ ·Pkáe61 ßá`]nf¡ªfÄçè¡d] ¾ wÙcùåH<©ºcûJÙÒî[XÖ#u©DÖiíR Áºö´) ³J,KÝC,ÒÔÜ4näì6ù*H£lÑ59zMÖ xMÄ{çVÿ /(á°sº t°n¥É Tx= x³äìiO/SeYÒÎTXÚSX Ä&C[y 9Ø%¦#(!OÖþê8L§¨õ3;Ú@kÒ|ªÐ/õ Í´÷ ¦È.:#å3 @û¨¢ê¨¢í×ôåFD/Óà«T8Í-*`è$j*);£}¹ n»V> hYQ<&ÉîYÒle æî¿2Rßú Æ6j²W4©GK½ »§çt|© 4Î1ªTm;¥6&ÄÂ¥H²Ô!×÷Qc@ð¤iA©R©¿ÑºO®ÝÂôÎsµ<¦ÄDz*Uó¥J*T©iT©R¯xT«úóÿÄ $ !1A QPa"ÿÚ ?ýUWùQ³ÁEp²3í} è¢c-*Þ(¡éþÉÉÚÑ|] ú2(¡ª:èlLNÊ1 N:2Ó$ElzÑÇ´bCb%C0© «,?Éé\ýÒFÄ*òO SÌxli ©ÉBÑé%/p´;±phÆôB mfBt&w¶{JÆü$YÙÇì#Oe£%ÅdV»,LËCØÐeC߲űi³h²ÈðSmbÇÞ¸²Ç´-öEJÚ} oáfEÍÊQ þ§ÿÄ 6 !1A "Qaq02¡B±ÁÑáðb#@R`pñÿÚ ?ÿ ؤþ^÷+ }Ô½üÕá²²LàªÜg#1îLp÷¢¨ Ý.Ôd À*÷¦J³kâ$ ¤G ªö|µW8CÙÄi 'Ôê¡¡P0¾ájcD6nwS¬ñÍÕ(tÝi¼f8±åImà¡Òµ`i!®PuäéP¨;²Çf6dµß¿öT-øG©íò ÝDdÆU¶%Ð:X o~Ïõâk¬Ð¸«" h[}¥ F §1'ÐÉ.YÑYu}wqk}× úöF⨡ 7¿ºbQ÷Äc~CC{aNò¯×wF;©Eĺ0«6 ¦ñ27exV~ÑÍ »£0 ê'wV$ ºa ÁЩ@hUºµ*+$£S<ÀE.®N/;³òÞ8u¹S"¹ÝYÜKt$,FêXæ ºÌèOci¢ú}lh¼¯^ë¿9Í"QÑN0L ÕªµÙe_$ ¨'^ è6ã=&Áì @wâòÅ«¿.ß}>K+¦f>,xdOä²¾|ÕºLöÊ;7üQmÇmM§ÓõNë#EÂÖôB1Ù|.twD\M!=¢í'IRèÕ_<-¶öeî=ÝD;ººX(ÈÕï¶p« ¨jwN«£¦4Óè2Fª6} aaoÌ"\óüE»gïâFe&'Ç)о"ÏÏi³sL0~H3dû ê§Ã¬yAÂ">ë_E$åïr´AN¡þ+ýÆbê .$ßáqÊl¦æ\ªôVPêE Dá §ê¤m ´ád@ Åí84?%®´£ °È=T}UméiÛB ZëÙ\,Sv]q~ª Y^` ×HMcõ\@½ÜÕ ú®<X(¹ÏëáÃ'ÍJ¾YÁÒ4ZÉ6F+Oo Ey)Ìiù \O¦[¥ÿ ú;U®V~¡tºá\$v_¢z z@4Ï_²0>9³»²ü$ùV@]B) ~ÈÍÍ '¿T¤áqXnÃg§M 0z³góC¦5R pÂ5ß>P1 Ý5ïÉ0=ïªiu VÞÙË÷ª¹¿Ë²Ð ʳ~¨Hú# 4Ö0@ ýZÈ! ªÅÖJ.3Õ PV« < ÝZÒ̯åz##*¸FëÂ*ÓÌód æ wdÎT,Ȫ_åÍ"ûÅ£éÞ#¾àayWÈfȸ]C;ó?¢µ#Uä'5ÂCIð´ÞâFï²t]¼ªådÙê«|» [¸x´Ç³hÝÀfàyC"+%qí ÂÙBh(1w* v9ü·¸ÉÐwO`lEü¿°«â@pî¸rP{H{¿Âhu,ÇHÝEJÙµñ/1Ûûü©dp_² åµä®W_4@ÿ o:¡ÕõNvª2±Ë êFW+fó<Lù©Ä(n9p*÷8[?i'ÌJ/¢qÚ7h')£Ã«ðêµ×ÜdOw}á:Èâ ÓjU¢oÓÜD8²x9n«ÑACöWÿ Ô ÷ ÉP1ÿ ÿÄ * !1AQaqð¡±Ñ Á0áñP@ÿÚ ?!ÿ Jÿ Ë©R¿ójWþ]J*Wñ©_Æ¥Jü*T¯ðT¨°ÈÊÿ \âë½3[u¨À<2¥JúWòÑÍQþ2Iïqt¥\©n¾*T¨Ò-æ2Ýn@E !Ü}~ÐpèÅU¯:(±Í1¤¯âiwÝâ·UèmjúØ4ÿ UãåUhôÈàhN¬`û ¤b¥ ¨Æk ýDÝÙk× >©z#eÖ ¶Ñ®Lÿ ¦8£JéÇ_^Î â8{{þ¥$ª³¦"¨ÒrT¯àdËA{Ä´ãí0§ R© l¾3K¸]yMú|¹ÚMÏÞU í¥°7\iÒ¡¯Ü©R¾·è½Ä -:~}⣰ÂXò«Q18NõæjV½²] !ÇÎÜjdPÞu]\Ï8öAtk[+Ì¡©R¡LÐqurÃÉÓè .ªþu%9ÃZØY¬g1YÔ«þ]~Ù¹mîÿ ¯l0 ðatýµÐmªéį LµÄb¦l\Q= -Ûbç xÜ XÇlÅÄ- ~zÎÓ_Äy*üEÐ]ï¢}@ØÕ.ëþÿ ©) k¸?E#élü;DÎñ~¼¼Ü`9§ þ¥Ø!ÕûÚN½5¾h i²µí<'T@óÓ S úå(¤g´s§Ü®Û=Ò!gN¥<ú½±ÁYqÅCkAà'^%@5t^¿oêdÊó%è¬ ØJí Pê×Ypa [[ÃQ+T¹ÅâÏù ÜßIP#Kv¼wñÇ=åLcCUÞPâþçá"ö+¨,¸1CL¼øv1ÚTåߧ¼`f`P·dNeÑ*6g¿F/0É®eµuséùûtERÐ6;õûcÚ òTXÈù°)ÖfëÒ¥âë ¶+äý}D!Õ*& ⣦X<>lí¹Bp¥6Ðï¯6ú%P)mà7ÕÜ4'\tF£´²¬Ë¥;Kà1õàB F[ Óì¦Y%!Y~ó7_luíä`Ug'>Ó^WgîþÑ¢ÿ æ(gÐ!±N· zíÏbvýLJ@Í_}@ÙTlEìTjdn J5=u/4x(C}>°T«ikeà}}%tâ]{MK{J() bI6 k¿Æ"gÐóý0§4éÀuþã|-*¯Üºùä,Ö£5«iJ#7Wn}æZô4ÊåR¬¹ºûMF¥ik²Îæ2u2f £\í¨ÄÎ5gnÿ Ü AêJ¶K`v׸ÁKµ¾9ô;þG B©Tx h'Ëé ¨ÓZÌ ©ÂáÅu õéħ»©W^OF¢ áÓ JÆ0e ¦^MGªëÞYß\T~o.E¹ ¯(¬ ?®?¹vÔ8»^·/4_-ã}³~зºÊMôcêóþÍB¦Îò)Ì©ãb´*è }içæ%ìi ª9âPb.]g½å °2'V¶(þ¢[®ÐhqÀínÈVW6¸¬ÝÆ[¼Þ𰤻 B/X, ù ±OäùQ@oW¶%âÔsùj$l'àa?·Y&|G,-õ{1tÕauÇ<ÍQT»ÓßSlMq{Ù̵`Áiw¶Ìçá.zÕ³goí_Q^ïâ×@»´8WLÕKºÞsInï-ÂõVìu2â ª mÛX ×:ÛÉÿ %Ìa.4\0GxÄ¡/æ'%L _ŵxjÏÉò¥Vó¬ ¸¨à¯aI1ýÄlvÎíªOÑ`Æo:Ë. Ê ÃXver¶Åñ17G :üâ°5~ -Æûs5£±¡8m=ëïCnºµ3ÄÖ®|Kn`BÑn8 2¢Ú/båHÑWyô={ARòjvÂF¨£GGYÞîßJ0 YV®îzvçÕ_C®ÓÃõ. ¡ ³°Ëåoç¼%àñÛ÷ T;Jk3HÅÏ ´|ÅNùc"{?D$]ȺVN°áiA} n{Wö[ëÞXK_¾ãgÐ;{¹+æ '¬ÒÞk2/\ 7->Ç1e®V÷Zéjê¯akãYîË>ah ôV /XÙY- W|<ôªÕTâá×¼=g>´±³u²ÔníçþÊ2£W{µj±fú~³0.\JT~ã××Æ%JÁº% ¯ ¢ðë¼qûld=1ªõéSÛð¾Ëvz}¦kG¨~¹a`áÈb°t WCj qçpC¡«ôçuûP=ÃY OÌAl±´(S^´ñ_:Ô°*¸"¢«Z kïU\óCuN °Æ 44ö<Ek¹] t[w >0SL{·ÐÆà¿!Ù|óFÁ×ÂZº½\öéë1HwÝ ÃÝ¿äçTýa©@ÖcR)®ÚßYkzªyû@+Ch 7îÎBJ¿yA_Ü®Æ8 cµwNfÕ¯¬¼¸D¥ès (C$߶Ù)GÒ³-(R9yélr¿ÌÇ1Í[ â2³A2Û´[n ½?pfà9u*xÖfJ7Ý*¿«WR^·õÍHUbúêh «7Û8×?@ªMd²ÊéÆQ6äý0vV&Q9þÔº¢ÆAÁëâ¹íSLÖk9+Æ\Ëm óÇ51dgn¥Ê.®ÔÔ# 쫯=4Ã/:õ~òý!l¦ï¦®2 Õï>¾Ó2ZÕ[;T¸3Ùº[ð6 #Ìáª4¯É¬Æo¦æ%KCP". dÑå¢X·â#f ¶ nìëÛo·Ð Ý7·-^"Ñ4ºQ¨©«FºJ î·ø ĹrÖÞ§Dðcn½£Z9éPXneErÕ·ún`ì?}CÂñEÈíãoH©[Xí-f ¼fhï85Õ!ñ¸¿A2ø]wú)iªï¨Ëoôf`®\þþ\ÂXÈRè%öçb>×55XçÏhêÊËizXeÐfPÒë;ú*4y,áÔÐ|Ó£Í{%gIìô..òùþáFKP-RðCæß¿Î"ÿ 8F3Qäém{N_§é\s«Èðß´C6 C] ÙüG>B Le¨EE¼¶é©Jÿ ³kóÚ`&wA!tÉ]AZ2ãzñ/ òrÔÜf¶9}IºVa>° QåýU²Çøë(5[huíÓñì.ñÛP4TèRòUl¨¢öÕñ\õí¢x ÙýD![r+ù :íz±R :Û¨!±¦=h¿K/éCc#7bGÊta¤îta8m,ÌÏX5IÆ2T P4bXËþ56LX±F¯`Ác¤"{ÿ ¨»Jê à¿O¶JNZÇîdZèô¥ói³Ù¹z¨·õ¹Êåÿ ãA A@b\¿ðÐÜnÝhloo¡ðbåúÇÿ ¹råÿ ;ÿ Õrÿ ð.\¹ü¿ÿÚ ïo¾úÛ{û?}÷Ã8 ,¡Clþë<{>÷û>ýì/GbJ1RÉ^[Þ¬ç.¢8zE¤¸U(~l3 ¹<yk¬6(þÖÀ°ÎªCõ þòPòE<ô¤nQøNí¦Í% ènjvµH ëÔA)Ïk¡D>r@3¼{üM o fßó ÆsÙþMTÛëì$F²6 1ÛÎ?ûÕæãþçø/¾ûï¼~'}÷ß}÷à@ÿÄ ' !1AQaqð¡Ñá ±ÁñÿÚ ?øD$cða Ò±?czV1èâA¢7¥bE ÐcDÜÀ(_ðC ÄÏ©}ý F ¢ öÚXj=&@VæѵÞXÿ m] b2Úº/Ö×ϵ[AX`¨Ä¶õ?b:ÂY¦vǶeçµGÞIÐ[ s+I¥hÖÌÀð Ð!9®'<ê°à`P@BJ\^ÂÍ =±{;ï^`²í¦÷$eS bÙzûRàÎkó¦`7*KïEÈ;C¬B{Ö'++PÐ6~ QG6¢,1Úä 6CH2ú ¦lÝ{ñ¥!U¾÷¢ ÚV¨"Ûq¤è|ubµþD&Ö§Ü ¨Ãw ¾ðj¼v~*q$.Äõ© × C²4ÉÓ¤QÄ Á{1.!-yú jû¸Ô*4'o?Ø%Ñö¾GxÄ@ñ ø¨1,ò;~¦@ §ÂÅ ó^Т%Õ·R?Nêþàh|óª¡ ®aÀw( àfHÒÙL¡ ¶é³Ä4"N»>qâÚÝ> Ö (^Û/Ôº k9%p ã \CL v¼1Z?M/vöµ íÐ º*ýÍ8²ãÐÔAÁ¡>b,«öîVv«D ¨´ÏEDn#¹?¨/>w3.Ã+ÿ CåTo ¯Ø+¤ ° ]{} 'Ô At æ äßÜ õ BÕÅèhzãXZ µEzBÔówÄÌy ål Æ`ÀTøþðñýÎñI =ĮɩqJuƺ^~icµ"2ùLkp+UÝÞyH64+ÇøÇ(é Æ Ã±Û¥Jæ:8Ô èºvÜkK×ø`¡h4ä}[CY µ åFô¤0aÞ[y¶£d&¥sFë°Ei ³Úâ³®6:ppÎ i +ÁðG ³m sDâÿ 1Xó )ðùq ¶ÂÖö?¶J³¯ AZ¦ü¿µw¼=oæ"+DY¢ÎAk÷AKbt¥_FµW¨CþÙVúAÁÀ`E!Áõ7 E»] Ñ(ÑRú-°Å ÚýéW b@T<ê=º½Ñ8@1J$bëï3ï5îå BE»¤¡äÓû T$l _]?p`L£ l(¨¡%®úºB0ÛP²wdì©0 BÞTòòÔõQ£úR!/¬$ D? q"~`8zÿÄ ( !1AðQaq±ÁÑ ¡áñ0ÿÚ ?T!>BT!>B!B Ý %D¸4Ø¡Aâ%^Ïô;ѪÆJ$´~¯êÓ!:1ø iàFÆ2Q§hºä¹lZh µ Ú§F)i§éðko9ÍÉßþñÜxe©[3zøN²'rQÜc¦QàÙÔØn+ÔÔ1 -LcÏAªwI½1s®E<H4&×nÿ ßATdù%îm¼SÑb¶ÝO.ò c·^£bÄıä2;«:gÙþ qäI¾÷ÜDÑYün9Íç¨ûÖíç7Mø¼÷)h;î%¡/Æ·®üÿ u9¾âzó Pv(Ýkø ®Üè5jË~Onù!og»ÇãöÄ:+G¸¥±ÙÑz^`¥EÌú0%* êo¯oèÕ;sðùAÎ{ a Dú¢ ¬ì¼èH» 4¨éy%F¦0¢ yÎu!ZÝÈèÁ.xl2Ezû íS{íð%5öϯìj´Ï\Ü'¥ª?<þóöCI8ääý Bè¨ N¢\g<ËØX³¥( ¹ìnõ)EMZ0бÑJKA4âO÷óÏдRÀׯÑJRøÒ¥)JR¿[)á|ÿÄ ( !1AQaq0 ¡ð±ÁáñÑÿÚ ?þ4b²,Éù&LÉ ûedr>¿dÉü0ÈdÉþXzü+?dþ9&Gü#É#þ#ðû~õõã!ëð¬æö϶FC'ÆOGáXþRà°ÉäÅ;ÈúÄøÉÿ \ô Ñ .Ö`UÐÙÃ?lV'¿Â漀 zE48wÁ¼ÁàMüÎï 2Ê`¢éK§¿ý¦}q(«|ů²°F%Eêt|ëNǪ Nh °Þ³HH¤ ]·M·4ÝO¼s B*Í<~CqL;Éc³@TXksXÉ&+ñ ¬»3?¥¹ÿ ?& -ÃlÐÝX5¹T6(0Ý\ÀfÚKìï½:xÖ¨}\@..¦ÏüLQ6 ǾOXÆ1óGc÷èãí9haâwUv¯7vÐ@¢¨w¡QDßMþ¬ U²èÐÓ^ã ÒÒP(ª¤&â-lK¾ù÷9X²#³÷#ÀʬÈU/úô¾Ë z¶;Ý¡*Q< Ô v0£c ²ÏLÙ1B#P ¼øâ5" ÊÍ ]ò«{ç2ýÆýF{¦;éM08û¾¿Þ8YDp¡ÐaêÛÃϼp4*,TÙµ7×·=ç* Á!k'1¶Ð6Ø êÐRh0ªIAAaw vyZô_ÛâÁÀ¥ôEÉJ1 n & ©Yj°Ò~ º<îqÀFÆB4Mâ²"gÓ¶ð[n.¬å òwí'yUh¢ò.SÌ°µºï>{(ìë3{@J íNMHª¢A|)r:vqé£Ïu `J¦<AÙ¢ÓZöaY°BQ1E/ïÑZÛÙ¦ÙOî dÍÙZ¢ Ý«È%UÍ¡Ý/ÿ ¬ òéð©_¼âéÕ%@T"ZMôôE_y<¦ÁGl¥~Ë,Æ x MIÌ¿NÀÐhóå/XIR=´xîh*L1ÅÐÝÀKCXD¾fåÂV.\ jÒ¦ç·?¼g+é Fî#kT4¾èô_,\4úi þ×Uá½è§]¡Póç»ë2$¡ DÓ~íµg+È*:UavÖ:Q¤vRí¼ò\·M2-¦êPB¨£A 16õδ+SE¾õ«äÁ¬TØÑwSZ®ùÜ08%OU ®©òå nÖÆûáÁ¯ïM :,Ö¨*Î.Iúÿ ®X1{ åãi @ª°ùo΢XîªãV»2fÕ°X¹ß3vTñ@miºXzW¸3kP( ýz%G ¨¬ÒÓÌ>¬|1Üà¾MBHUk{ÂÙØé U~÷¿ï/Ô$¤iÏûÆ?óLÐD/°kŦØ@Þ}æc.lÆdcZ%{Lðé·ñ?é¶" ] Uv¢Ãæ ô8o¢õ·:»ÀÍ5oêú3n æñ¢ÞD:ßúõLtàÕQ¢M×ozÄ 6¢Nº:Ðr1 x¬¦²i04Щ7ÁóÐiðݺ:swÄÛxT¾bô0 XâhkÞu1sðt#³$-`Jm³Â<HLYz`")b1?`üfÞb}WUÔ<{yUz®^Å (K· Ï<×q5H+ лaw¡uß;= }×ç"tD,Ø ¢t~f'<?1òLLHCÆrSf®å&è Ðv{Â\`"JÙ·Í'¿/Ä Î Û j»~ÿ \5 %#É¿Þ.Dìq j¯ö;òÅK4Wðw9ÎÌ8w'¼9ÒÀíF¨Ö$ãc§JIRC9Ê|#çt #.¦ÿ {±49 iÎþµy ÇnAú¿ýÅ7ø ÓK!, JH·ØH¡Bí M /ÛÜê-æ Ý ¥[n f ¨ ÑtÓºL=:¶|=ýåEóA+ôR¿& Y[³þ} OÀ3\'m£E64çÉ³Ï fëfR ©ûC¿'ªuB1 Ð"¾Ç3 Á6`§2Êb°]lÆ&(Ò M/óÎç d^° ªº=ªü· Ý/ÿ 1b ©¤d÷ëçëð\v âM¬©l¢ I´M>ÑðÙÜ¡6 ÇÓý$b@ééj¶öU§\ää|iÑ¡|ôMB>B 'BW¼Cj¶m@ AVÈ¢ºÑÀgѵscÕei Ö^o ät.¸ W{q:&%ò)O$:ïÓÉZd´'M@Í÷J¢9Þsë*S9%þR³¸çø0Z ¾[|Ë»e²ìWt'cIm<"át½Bªµ¤Å³KYcÐö:ÒÁZ¬$q[ÅÖÑA!ãÆÒ X]ì Õ~ÅÕ ð¼ÓÖ«©&p¢ÄkCµZð e²HvݱE$Äø+î|@ðÿ ÀNÛ@ðÆ>cëlG- ÛÉ,£Å4Rï4¤ÝUCoßhñS zÑ4rtâ \9X}k·øUÔº ¯gX»0hõÿ î@òëór@«àw× H4TTè¢MIµÆÃÅvB&èÀYs@t×È@ýÃËÞR<iŠШTÑ]|¸~%-b@ehKk±4. 5 j»µÕ^YJ @7Ñ¿Êg/?daèîæðDÜè+»[5JÐhPiM?Í$4%¡ ±éIÃp,°¡ÁWöûÍá ¯þq sËmb MÎ-6à¾J%¨®Æ«±íÕ4 oÀEKQ h*PèÚ/B°éÔi¶= CCO ´¤_x« /4 SÃ&Ì¡Ó&,ñÛâÜ¢ÀeìÜ ÂúÅRõ¸¸þó´ NTuD¼ëÎû µFÊ7«A´ÚÇTãÃ&®&+ PjwÆå`<¡ÐnÕ(DË h²t¶® hº%)(ïÂ`Bf£~uÝeþÿ ÁU«q1ñs£wµÍ)-Ã]Ä i¡[4ǾM&ì ã Ü jnÈoÓ°¥ ñ0á±Dìm¬VñD+`Æl)EJh\ èrTKg³]óøÍ1ÚSà§öau i { m1 ¾b¡¹vzÝ\0 °ÓfÕ W©/ %ài@:ÏGXT *]¨u0JtÅù Að Ô Ô@CÜù!U>Õç HøüG %³kö¡öã°Õ JCÛú ©hQÄw â½d@MÕßA 6kÉ° ±(@^£´¿Ùíï=ê`2 X`õ²nWe<Ö¢ªhtìIðJùì9¡B¿ûx Ã[Á#²Ú .&9¶¢Jª ¦[ BU'Ö° θD@TÚ}ª ¼^(YeÈè+}¡¬Lêá! °åLqm°ì§V¢](l | jý-$¸b£Âû }âêK&XM]ø:Æl #xÛµÔãtu$T°´ »!ñ 5 ÂÚÐצºà7´ÖÒ.ÕoÊ¿8Bh¨öÀ?Fx1vÐíø:ãh$JD¡mÖ;~µPkI gµµ<´ ÞE.ç ;g© Шvi õÝÝCMÒ¥¿éÆý#í.° ßäCô/éÉeÖPEØAÐÂ9¨nA)TUúpH´j_6B³H P@@Z@< ÓVV¯íÛ¤ ªø2ÅFı,8`UÏ D ð /q àöÙ¸Z VÄw]· Dè>G×ÖE%Í à |ã j*Â&ÕÐãT °Ó×`ýó¾gj»ä®°[M=êÍÌ ñH<ûÂØb5g@ èM«4S`ªðÁ³è¥PZZÖ¦R¨F]Ç{Ð}G7Q)Bíß ÒoSab~ùé¬8ù$Oû¯÷ÑVÕóùEø¯¼E<"¥MBºÍ$Rªô/`¨^ Ö5ð¨ÓPZñ¸÷bºä©Oø pâ _lôaGô@È¡ÙàZ5Á@$Zе¾oª¡ªí×>»GÅÄÊbcÂR)Vü¬Êä{ óB»R D@ª(64E O³¸`4:I@Jè*å;U"@+7Í 08Noh 6¶M÷úG Fè¬DDI}Be4!¬UÁ¸qdFz*÷JÔZò®v:ëÑp@QÁûtëNè *½° ôL7m[ÍØ=Q®;ÚóXR×1Hko]o¬+RS<9ø"äÐÚM @µ©MV¦¦Æø Ȫ1G}!ãÀnmŨ*¥O±õ 4Â+`ìß ¡È ùY$E-QJsN ®5µÃWË©ô~ Î ³YµÚiòöë8$µáàXY^å¦D"U Q³ÅÍ@úMÉÈÞ´ ÖGèõj¡Fê÷í éÀ! P²þ¶ýõ-üÆtd v<×#GXé !ÐG´v\>X T!Wua lêÈnvtÀÙ?ßØãÓLM>Çö`B:=%±<©;¬pÎÔh¿m¨¿T ñ ¾8¢SE³ Ñÿ çXo"¶§ @ -¥ÓÚ ?Bªpu ¾íiÍÙ1 ÃôGk,5 @ Hé0õ´xÅf é9ÿ {Éh¨ÉDÏ>(î&n t~A{÷¬×Çàeè0¥¬Êl¸ T1 ¦êNvîÞMjyl+¼Ù#ºÌ`±P@úÍ åÚÂx î·¯O§è_ X¥gZ®º»û¦1 Ü6ÍîªÁ`ÆÄÖç; \Tܸ pV Ù\# WÁö¨!IáÒ<Ei̱Á<Ss§ßÇ£Á{Ê+kÄ4vÖ;(êØiUgmêTUÙÍMox qÏ+³^VF÷y @ § á,»H;éaßÛW.I3a$¿AwKXOÅ íFìØ _÷Ð|XQ^³mRÀ@PRrg#ÐcànÁãÂjÔ-odP ÑàéZEAH_éý,Ð é6Ci^G,ªÆRCr¼tkTqËó2ÊÓå ú X¢å t)¤)Ùc¤uÜòµU÷«Ì £PºÑlçbë,± ¡c Ýð{À |Ò yÀZ%ÜS"A*{×lØ@ÛáÞ;õàw´W»Êþ. Q(DÄ;¶×¹ºa9ZðB¦Â#£V HÂ`øSÈìX¡Jp««Zp'¾º0=â m¢î íÕ-I Ü×9ïíÏ 7 ëç \¸8$è% öï^z ÜïS&Ë¥znA» 7:G³ YÈÐ ºV»Tú ÔJ-Z8YúÝkÊ-<´4xçëÏr£Õ7 JóÂo ²`j0*¿[õ|ñÿ ó U¯Î#ÞSÞ ÂbXF:Ü]9ECuõuÜÕ=ñfÇÆϺ c¡%ã[ÆÙK©¨0ôA$Ñ'ë 3p Tíò.·IÊbnñÓã$!Õ½CK¨Ôde`ÚzÌBi4Fíßµæ\®\®8ë 5íYú |®ð h¯´NõøÉ";; tmxjùøæ @lGM¾1âûÈϧà&!*8¬O´Q×E 8SíNÑ}[/5xɪó×&85)HÇOiòo4b$nÎëYµC4Wéòw~ DW¸áWò3Ö:E10Uã§|Gab Py´aÞöc Ô? 5<QMÓ ;SOïí< ò±×oUì÷OfÊd [½0ç1ª´ú1Õ]þ)Ê{Êåq~r?ÈS °£ Q )8`$øÖ7ûË/æ¸8å<<pÜ¥8u0RînÎI Ýæ¢á@<âî AOXUËþJeÊåråråË+ü)÷ø®\\§¿ÁX·üéË+üª~üëï+ïü®S.Wùiï#>YY_Íråÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 11465 |
| Response Body - size: 11,465 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ å ¬×5æê{¬N=yT_S$ ¢Õ+kËô¨¼\±ÒnriËýÛfë fy»[._&º~vÇõåÉY,o¯Ì îËççÅØün3Lí¸KÇ/÷¬ÂÞ'XŸ{ XÛ"Jjo ±xÜÕ£h½ûÜ¡Ý ùs:ǼÛtÌ^ó6ÇͳåÒý¹~ñÓ-F··o%T K¯Ú#ù:ÔVÝI,dcYGúYï¯HôÜ¡"õ ê;G Êùz÷t½ËÁÖ¼DßJ¥@ßkªÑkÛ~g1®JÆé9 £IÊ!MMèréNÈ>Ò=ùnÁÞzçZ×z%Î;ðKïò Lì<J%û¶Ï®òÛ¸JÕ6_\ØþãynæOk·åÑoùjé´ûMáç¾òͶäì]«õcmä-MîS{ÜãAä_Kq{-@{x Wná]_ÃèÎæuɼj%ÃÉ?ÌNWª°,e±LÏlÌ£ËåZ(ÇT-]§È³zý+MØ325 OϺ¯õØvë¥^X ²ëUÒzóζo¯=ÇkõÆé7¦åä>DÃÉbrÖâȪ«W|© l;Úo±dVµù«Åÿ =e8r¥tÚ¾=Ö*Ú77LÒa Üyï¹[# +J¶]iYë7Ïxý;6ÇÍz>ÕoÞD= F¹{ãêEé¶zC*åîá¦Ö²0y&ËÕ«5®Xj Ô©=þP û_è¼mYO x}Y{/cl&L$B¯ûÝ]vÞvòcÎ̶Ií5æ IZkÚ«Z÷y|µK³ =ª®íoÂìÍMקg98À§_Æâ½nmþö»îVÂa/Åô1°êÈu+Üâ_&ñw¬öä Å7P÷)é0y> ²zu=" |ïÅU) fóç=ñ:ÙBð ÿÄ + !"@#01 3$2PAÿÚ ø:8DºW¸Â¿âZéÃ+J ¹T\« ß?¼p2^mçíÈv+®>®W¶iøñÜÎ2¨Ó&³ð¥MCìãÛWú~àÓí`+¥f{éëÍmE>óã[ Ð1\]jÖ<¶ö¶§qM±¸]ié6\.s ¹R²TÁD.5¶¤`W¹_R£¯lw'MØÅõV±"¾ÐVÈGGi²¢ &&½ñǸ}<ÄÍÝ/²ÃµtIé? K&¬±Ó&® Õ¬H7/"ÅqFé¶ ¬$&b<DÑ®©<7ßÚ¥ÇÂÒ'ql0cévB2¢$ÈÛÈT ~«> pP+Äø?îõÔìì^¢C¼dÒü¿O¢É b 5ñã A r IwEÌQÉANcø;> ÔýC¦z´ÌHÍy"ÂÐVOâ/ȦóS¹»=6ø "\«ÊæåPõÎZ (0ÅHõPxhúr/àøÊsþ±_E ³Ó}Â"fß°ºN¡oé®-³ ѯyâà8tÝT¦Á'+ÚêßSç9¸%á©ñ=¿®ôQR#º-øä{:úÃ?ÒäíuvÛi·ou°Ò¢8ÏtüÔîÞs £ÛYóM à¢`AÔV7?é»íÉCg% ¦iMß :`Qo ̤·=¾"ûÈÝò ¢sF½ÅÌjé>®Ù+g粧¹ï¤ùµzó<K9ñpm_^Ü!;Iã¹a¡£ à¨ÇõEAZi÷A¨èfÍ¥\í\îx¶0G+©YMÀÍZ7lÔÄL[Ü£ñÿ ð=ñ3MP<-´sõ éù@¤ )A7R®Ýq ¥ôóÀ;By©·Ôø¡ÅOÇKf|O$RÙæ㪠2ñç·-ý~«¤ºÃòÙÜJ׺ýc·=Äé.öWV[nI»NáÓ¿Ñ_×ä¿Sí=Py£P,æc4ÊÌ®ø5ón+TÕ8]ÏÁÓîùë¨ÌÜn¥å¶~Ê®Ê[Dë=¾¿u ©¸!¡ºÌèÎà¸ýÉLQ\Â/·Îº_ fD´[l®Ð*«2ÿ öU>Â.ú¼w dà iE«ñ [Xøörw«<ÀŦ'33ñ>v"ò7 ¡bÜí¦}«÷YÛi/î¶{¢ð½=×L¸S9e A³S¹%]µ¤Ùøº+WÐÍéA`7äTx=¨dÑ LCpØg²Ö°RW0Sn3 èX\`·ûõòÜühH\Iª³Í{wf¤²N½ÛVw\DW* ¥ßnäù.<ÍÛxU~@-9aü}6öt,%dA%±S.éøçñ1ÿ :ÝÛí ÆÀ¤îÿ âé·ïRz«Æcàÿ ÿÄ # !01 AQ"@ÿÚ ?è~ÉFû±{øÌ Q%ñÖdQ=.lðÆÄèök*T4ò# LlS,lS$Äù% ×Tu)ö] ½² È^ÉÂùD4¯Øàhõó¨zÄ8ÞÕ²Ù½²,ÔWýtéÊÐö¦ìÆÐt' 5ïævJi"2Ì¡ì ø4VòV8µóRkdèøËd¬Hhq£râ×V±.J£!³ÉúgÎÓ×Ztd) vf?btìòväÄÉOüqCéÿÄ + !10A"Q #23@BaÿÚ ?ìK0±hQKÚýÞ³?>é{ãyòæÚ}]4ä.;oåO!nÕ=uiB¼ ò F%9ÃÁR;Êl^&q[ëµUWÐ*jÑ"æÖYY4®© "ëíý¢mÂk®W§Õt]gpP7ØìÍBù$Ë-) tNM¢<¡ÜÜÐVMùiøo)¦Åz}xgñI©®,7ÊÂÙ:Hp¸ýê© C-åGéÍ2Ô±[SÉôîS%s>¬í§4;!Á È@÷Xq~ÌÛJåz]^C¤îÍm%|©Æ$&ïE9ìéâ[¿´Ç¢Å× ¤5×QÔôä. Yz§7(ìк'âýñ**ÉéE3%aýÞÐábªáÅCIw`UMb T¼ßí A3ém¥8¹ÃñÂÞ-A§vWM©Ä4 wÂ×ò¬Ø ,TÔ· ®jÿ TÑu áµÑuþ)ÑÊx+Ú_ MIó v½J<à?ñr-ò>*6اB\.ÜMµ¸»Q§»6°ÄÝA¬þÛÛq)°ZáIc7u > £N,ÐØ ÜJ4Mît{©ãÊ ðå` ¿Êcqìÿ ÿÄ ; !1A"Qa 2@q¡ð0BR±ÁÑ#Pá3br$CñÿÚ ?ê.s0(Dn+cCHÎ?ekíI'<(òM¢H¡Eºiû<L£ ÎöiMT ³ Ø+Jp05ÍÊX ôݵ¼£Ð40^!ÂðÖ %?uܯ³¶£6ÞQ s ð¶«ÅKPOL:hȤȧW`vR©Í³hÍÚbyU³ðM-ɹ[«-Êê\õ¬y'sV Ò5¯ ¬1Å5Áùi¬¡ªßDXÖÝP©ÕOIÔg"\ Æmº@Hùí?í,³lvz©ÌK{Ù³ÃDÛW à¶Â¢¥e%« ¨ë¥´RÂéXwÓûQîràá ÌpÙ¿©Èp × ¥ ìR×(´i ó0¸lü< Þt7³!hܱT ÉöV Ó Ì6cÎ=ð6eÂÚ!Âs_§h?ÅÙán#0¦*°¸QrÎ æRéÃMú,Lç0æ¸v!oa £ûC¢e`ç`´´B ×W {1Gt£ëïCìÜC U]ÐÊcì Ó§Çòöèrï@Ù 6äÛFÿ UºqÔ áºU<Óc¾îYãoÝÃù®ñ@Ü;3É»zÄòK´¤-ába¦ìQc;qNf}e¨Þ°3´ÕiµAÄ }£ZpjÒuíAögbÔx8 DöhvßTë3ÑuZxúªã¯2©³ÐtPW'jz*X*·°KÚd{ðæ'>ÑÝ-\ù,È Ë{8Åb`¸ ¼°øsß ¾.¡æ87=;V!Ä×Cëét|M½Í︷ Äx Ë §Ly©W*Ѳüû}}úº¬¡ìÐý¼ìÏAßçê¬DÖ Ó5ÊìL1h<ûQÑÍé3PTT*cÿ MâÆ¿Ô yÇVr±îú^Óܸ«"]¯"¨jØ}Ô ³ êÚÆÒ¾¼ú9¦Pe¤HáYé'o×aùë Õú^ fbѾ|´láÉÃQëÖjnå¬ÀfÑÓÛ:ì;©t.ò(ÎBz[ÂÒ6Pë8ó ×bÓ ý3»rÇdÏÓ.Ü ·³jÑGG¿6ÈÕªÎ3ÅõAq_eÊ7hD8oBÈifíâè5µÙôDëÿ W\¯#}Ä|ÕçÚXZ¶Zê¦Y²ÑLUrþÎßøîÏûOãß70lÌþ.ÔìJ d0¬Ã3vª- 2y±k8JÅñj.l|b??kâP<É¡¸åu0¸nÈ¢* 3ðñ~xr_³Å:ÍÔ y; ñü«ò+AïsÙ9 I;Í9¦âÐEÜ©ý3[2w0î3wxú¦ösK45 >·Pá !ã1yfµä ì+³éµmX´±Ç nô`@ÝÔ £2â jÑRwÿ ñælT]ÅURPɶ)קjóºZaDZL½´þ Ó³ÿ ½L! K;YíóDY44 Ã_EY§öß÷º&ÑÛÔ nÞ.ÚñX\xö¬*Óg&a¤y¬mqÞªIêÄ3£uõO5Lôív§÷®ô÷M4TRT®Q®Aã#X§e6ÓàuBiNÉÀ0a[}Ygý?5³¥B;½+èWöÅ ¬-Ý wEß)Xg£D?Á íÙêà¡hÚòiæ£uƼÔ`íBQÌç¼)³;':i´vN`³iKNÄ\zìí:9pÕÎ0sE;Ê깫H˾þ aÕMk{{E»!l Ù\ ÐrÅg]?)¶u ×yê_ÿÄ * !1AQaq¡±Ñð@Á 0áñPÿÚ ?!ûw38fXAÔ"oÏþ*àÚ TÛ&³¤½Òs´Vú'þaq¥Bè] @¶f: L× ½MqçÖj[ÉFMOxàgxWÓ 3÷кñ3ÑTÝ"êÚ \`¤QPF¸äk+¨kרsÒv Än0UFÍ%¬ o§ff?ì¢à §O·/äLÁ*Òi®#§BàùÇXî`0¼Kä7ᬹ1/ZÀ¢W Ý o§TZB½´© E¡Dx#dAøM@Òxu>Ù¤{.+êæ¨ 2\Lx@²§BA9IeH ³4twU§hP)¤ýÍ{³FaÀ ©w#øÌ ®0éìÊ8Q°øî §¬%ùGcoöö YW2¬5öÊÜõ[lÊÕuÃï´Ç¤{MP9MþvÚCÑ9 ¥ QÔÙÀ5ÑsPbe¦³ 8tÔâ`sáÖPEú*^³öö EÊQåíÇ\¢ÉÐ_ÙÖøèÊø¯´¸K7úÀ~e væ !Åq¤ªKe½ÏÜÄ»ÀòÓÒ.÷ã)É(ú*5 mXNÓ4÷ Ô´üChjF CW3<{öþCKF¸þìòHeñÒcj¨[Äë¹à·¤Ê&6fY"Õ1q=§³Zd6üW Vc©*XÉ°B;·ónCMR'ñ£o¶¹X¨]©Ì:S0ý#U(¤fö LñRÝÖ {ÂØ#Ö8 G¯ýþ×pF [8Q±wÞ¢±<Øo]ZixUÉSe!åV4{sÛ^.¢ Å)`y^C4Å, £/].Xc]ÑcßËéi©ÞFÎ ?]:âÿ ßãØG03 ²X½ê_MT$.Äáý> Pj_ÄÆnfàúÄ<o°ÓÜéON<<?¸Ò¶ÇÖõ¼§}üe½@¼lF½c-y¶}| }\ñàc£Â2¿s÷zÁ©jÛèb'Ìo _<N÷æé*×Gñ 8H`)î}7 ª¹iFË g«ý>t[R|xÃhFðÀ kGrZ½õ+{£ÇûÜB¸md`0[ÃÙÒ Á;|\ËR-¡a ÛÇ«EÕÀÃÓêµ/½ì <Èt¸Äl5 ½#Ä//púìí pÿ ·/¨éoó )ÉÎÄlÊøªÍiÔ@H#¢oô"¬J×Öâ³ê}oê?B0;T ë:û03 KòÉ«àîÝ Y\êÿ 0åjÃóËHîräÍü\ M¹Ëìló¿dh ,ïÕïá8ú,«·ßfPº c-ãJôÀ©õûfÔÌá®9óü,µ§gÑóý Q ÉìxÂ1w®Pí kB»¤×ì´mÍH4·UÜ&ÆqO^¡ôA¬M¯ÃIC68¹x}NøºL`ltO e¡©sã×µÂ!oUôÎáO? <pY£¬¬tÚü¿Ã¨¿¤ºÖ½xËuu7´©øW'â{ÃHáîÇz¿È¬e@Ù ìã<rØ2v5ü0òrté·§÷e{ùIsHmáª35^%ÅhÃ(NO7hè¯söóp¿F;FB!Hï*UÆÍ[ZWÒ¡Ø5qwäüÇÕÈiÖV= ×Ðj\Ò?Ad5Ç ïÏã è¼]¹é3Í éñÇ÷!Ö$¨3bª·¤FXÇBWÍîMEÞð£ç¢N~~b¶Æ/Ãûë F.Ñ:Æi9ënøùÒ5:¯ZL/è.¹ý <oÙ 1/ßÂÓà ãèÎ÷¹õ.öß}Þþaò²3,ë¿?5ÔU;çR, ªð6öÍú4ÉUJ4_ ·ö¿ËL~à,6Û&bW¢ qE8¢|¦!àÓÚ=s¹5¯<¦ÑÐß äßE¨»Ì£Q&cQAâ©! DSPU'Î4 ^IÑù¤3¦h¹tÝ}¬ÝvQwÔ º¸+CÒå¬JÕ:@Rô, Y8j¨ Ñ¡üA |È FZJvxñÌèêË»ïH¼oÒ à-f2ûDÄDz7 ¯Bh¿ä_¶µÛ]PuÉ\Rdâvõ%ÜÊ¡ÑêéÈÓ?'ÙªL¡#ð|´»~\Þ()zðô~d÷z¥H5G<³ÁM¸zJ©õ?0|;aB_Uá ÛZ}íûþeçUCÕù©í§6F; ùùÓ[C¬óØ~Ñŵ¶yv|^ÍY¡Ü²V>4Hà oëÝÍOù°ÝJ»Êa>aó§¡*äi ñ§Oû×3I·(@æ.\tzÞÑÔcÕÊ]dðf õí M%Ù zßXyZ}¶X6V³v¼ ø@²Ú=Ôî·´;Ìr áúòç ª*H(6ôÛÊZ]GLµÒA¡:2æÆQZgü>ÐÖÞ{ÞÏxKð_·«5;û¥¬³÷iPàñ µN®L.¦B¾?w00Äw D êÊ´üàªa.ë/xv%° ¿pÙ»îzz)Æ«¶ß§´Fë ¤C 6/ë¢ ðÿ à$S2Üì[7_ööñ"NÑ¡« ´« ¶Ýñ úhºeíôÒi×aÁV peù°}ÿÚ óÏ<óÏ<Æ/üóÏ<óÏ<óÎ2û¯à¿ÿ óÏ<óÏ<óÎI©Ýh¡tóÏ<óÏ<ð)Ù×,&Ì6vÿ ͼóÏ<ò7ëDj9ßþ~o¦óÏ<óÇäÌ\ÎB-!3óÏ<óÏ<æ ³JKG<óÏ<¹ä+]iPZnE¼óÏ<ðÃn¦³¥%ª¨£+|óÏ<óÏ<"¡Wu"òug¼óÏ<óÏ<æ$ü{¾Ï<óÏ<óÏ<òõÝ[Ï<óÏ<óÏ<óÏ<óÀ¾óÏ<óÏ<ÿÄ !10A Qa@ÿÚ ?ð.ÄÇù|òçc L9h¤#L`@:u Ù"NÅÆ.S÷ÄG!êÀq.ߤÚX@õð¸Ã²Láðúnc@!)o6N?/ê¯ÓÉ¿ÙNö+ÜÇ￬ àñk2CÕ®þ exH]ÛÝ#ÿ ¾Áì03 <[<° äþ]¤GF̧sîE¤ m ê 6óHORËÌ l ]OèXñ¹dûõ¶²-#9°-,rwcÌpzm8a}O{Ûâ}l°È[" Z \ énõk¾6ãñ`hÈåÔÏ9Ë®ù82÷ L9þ5SÖZïÿÄ ) !1AQað0q¡±ÁÑ áñ@ÿÚ ?ì¨é,íDÞ äYcEº#G ¼DE sú:OgTÌI¹£F{GrMGÆ:ÜRÖ nå;د O~É7ã2+hIJ:A«á2O]}ÁYG\P4Vâ¥î{!¾Á~ Ø ÐË.¿:IÞìs]ØÉåQ°àºë§Æм¸º|'¿÷÷©É8% íÁä÷Êñã58-L ×îCk_#IüÞx Î}ÛãéÚÎÖ9 ðvîÎòÔbâT¥1 Õ¨èõÇX%q5ïó3Ƚ? Ãç¯DâfA ò¸¥ôx'Uμùû8ÄiõØÝé{ ©~kí¤Aò߶¼&é³ Gj¥Ó¿o=>³.øÐSJ~ûï2è²ë÷ÕxÄ-'®½j *4àþ¹øLá¤yèìîL?5rÄXHâ8°BnôðçÄõ<#HêA þ&r*+Þ'̵°ôúö7FúÏ×Ì2l`Lä½ùubÆÅÝ/¿8À² ß Ê~å¥Î'¯â+¢\¤É0µÜ Ê£8W]tLW z HEڴ׿övHZ1PµÇG¯ W=&RnLãHSÒc¦Ý»ùAutHKi(ì ´ 8ÊJзå.·#Èí\½`Û´Q×,±¶ï êà*ñEÄq4BØÿ ÿÄ * !1AQaq@¡±Ñð 0ÁPñáÿÚ ?üc £ ûYkÜe+JqÈw6<a `^ vG-ëÿ ô¥_:L¦í¶«8®ÛÕ¼¦¸ÈsOBoX$©6(Ôx|å§C½kÃ`3 5Gÿ p ABeý8ä7Æ<½3í ÿ TÀ9\²ºP4vlÂ4mõðþóË8ûÏëÞÿ Èÿ |à «- çgt=oh]Âr=þ`ÁHÀ¼æýP!ö'©ì7eI©©§ÏÜ3¸H½÷ø¤å@èö½öLãRù>qJ46Ð]v ¨ ¨¸ zß5ÄÕ+OÛ¬¼jjÔù>·ñÔ! ÿ MÚÌZ ®, O{~¸)Dt× ë[;T hòü¹(NÂ3¯Y Iê÷íÓ¿¦R á³ 0Æ*xÁýüxp& »AËãöp1IôkëB'l\È:§&-8"áûîð³J×;>ücDlÂÜ]1¦ë6Õ¸UM?|c6¥uæ,8 -sº¯F¹ü³-Rs WÕ>r!Ä[ØÖÿ Q?¦_ì [xý?û$:í® $ÑàÃDDÐ[&ü fýJ#Èe>:Ö¦ÂJØx5Чê>#õÆ@±¬A!TþíßQ :Øò_êbùK¼&Áã¦G øQP¿Wì$møìDM8ÌEý^¼&& âèxÜþ`5ô"oÐ¯Ê iúÔð]² u¾*ë 75³W½ÆkÊQaa¯¥øyÍ=½@Eñÿ 1AFqÄÂ&ó ëÉä ¦í åAz#VÎÒµ$! W ¡>AÈäÞ)Û¯ v Ñùn5ë%ùÛá#õ<eôN2ÿ ìç¿8@EJ¼3P<ë4 0^ðùÛÎÅ"îGj®w«£ÞÚz26w®þúá7] Ãf®²_É(«K>ô ¯Æ«Q§8ù5¤ô} &7ÐHG± º TR>7Ó õI _N dÞZírxüÿ 9fón![uMÙÖÞ|}.Jó® 7M` <M°7ÄH>WìY$wèÌdh~²ßÖE¦ãÙÔÉQ±ÛÇVÙiD=Iüà*ÍqÀFrÖè¿|sþ>ó û"+=ö#ŧ8Ü88 ÄÁèoq°íÜاÌ˦HÑwç4Oa»è 5X¯ßHö#Þ Ï¨i{ýp4cGȱ ±)X'1AÂ* ¶P¹¥µ¾ÛßÏý ³&Êp§®ÍyÆU;ó¨L ALØ1äX{rà À7ß\±>åéÿ %·ü®:o6L6>áìûw»MAY§£È]Øljt ë+Ñ ¢ø0` R *øAÞõ ¾]ö:Ízʪy%Ñï·¿/ö%ª"pë £©ÕdǶ5Õ¨«i׫TÄÐEî#Å)GÒd)É^µ«|n)iHDu¤MXóc Û¸ÐÀýC zæ-Lé¾·O¼Õz>|`(uϬA;¾Giá{8yÓj$zgý¾áø-1*¨*ÖÄUMùR âcRöØóþ; Qûbó¤¢SñöK:úây ï>|óç lÐ$:lú!Zy8@|°¿hðÓß) §CÈts47 £È Ro]ç=FÆ»wþç $¬ýû`ùÐ3Èèh®ß L¬Ö h6NuÂt átî ªÅÙjV¬ßF+qãÞñ:£Gn¸+m=~µõÂ.ÓHðå¨õãðJ< K¥Fø^#\'KÜà oI %?%뫵àQÎseeTÛØ¯Þ Ô ÔÁNlì§O5Lmöùx?;÷ &Hã`ÑÊàñ{?¼ï °TS iKFÂÿ ¾]¢¬ÙÀðq/@¦ CÒüÜ>xFÇ L i*ÔUND×`-½MúCBrñ.+Âr>Ggxoðb3n%(Q*Ùà 1fÜ0ié^àmløÀæ§ýOü @C£÷ õÆÙÎRH« [`®¼{Ä>ññh ô61äãDyHk÷rS¤¤=ÅTcã#/XGë:Ð °"»UÚò \ßÁêu) 6ã7¡^'~GJ_Lò`mTí EYB1wK>°¸1À9aFÛòV%pdâ!(ìÑ6''²Q³H">ÀýsEO¤)ò:q u± ¸VC$h A¨-ý£õÈ÷Vü ýÃÀøëøúa 9 P\ò×" Âü3R¦ÅÙñqE¼ôÁ= tW3e²'ÈìÇ `°^Å|¸(pÿ G»Ùß[ 8Y(ã{,êYöî ¥ZàFª4[%! AE Æ~CFв2°§XQî : ÞQÑÙ@^JiÐüÐW\Á¥1ý¡ç¥Öw¥ Ô7ÈÄðû/HÀðº-£` D#ßá%X¸:- 1tå69&µ*ÍÌõø(êYÈ7âk/xCsiS³Á6?|nקC×Ù±ï *hç)>¸¥7ygr8ìÆ ð\÷A Óé:¸gÆ^ÓÁùN>í· >§Èd D¯ K3Ú"5yÒÑÐéq5ÙD ©×fͤkO.[/ûÀ1ÆDU×0tjÞ?_¾-%$+¥ 2ñÄpõ¯òu8Ý~N ±^öKÐnV#½ '¥Å:aè "vc8Å{:Q®0±°½§½ððíø¦þ_Ö?\ xc£Cföö£4{ÄTc(ǬBÓ_°ò ÷ë¥y<!ºy23y´$ØZ{Õ¡¢c÷\Jè©6jr 5£þÑ®§Ù,%ÓUy×˵«|M[Ûiüâ®jõ)§àßÕÄ ½éDù³Õeo³|vþs 2vT)µäª,Óéw!þ 95ìw÷G>Ì"YBE£rù5Õü )Ý·É:{BÉH)ðÒ{1_ò¨ ]ÎO¨§×u¼³|&ó]ëYNÈùÊeªSáxbð誳¡iD£ñÎô I<ø>¡ÆuÙ8û¸ .°Ì3IØ7%.F»^³$DÙi) R¨(&êÁÆÔ©Uá¨6û8»gÑäÎ%(ûñÇ(vº ¦Z]xçð I¯5¿¹xéãMÒà ½nç ³gî}Mý2#ÓÀ;ºÕà ` K FÄ{x.ªTç Hûüw[ÉõÁA,LÙIðÇñ1Ø<¯ÎT¸Ò#^¿Î*ªlr*WË-?#´æ;:¸4 8ÃfQXO O¼WÓ°¹?½L`"%`8+âßY-Ôìår>F aÎBJÝuÄÁ® èl÷þÕ¨µ þ&H¤äjº`Ûûñí`¨`y MñX-ãõÏbÿ » !¡AÀ¨aÆä\"Ò1À2tññõ9$¯IÁ ß6\J IýÆzL-¤4ë ðµ®B:gX Bð=sý÷GéV¥.Î>q¢ìÅ>áÖÓCåÖöªÖ÷ û]¯É¼@¥ÀÆA;®`U] Û Ydß!D!eàâ.¿ùGCõþk=xÎ 5rAü bòõ ÇÔ$Êä ª9kr¨çoßùÊÎOyð[Þ"X¯üï¼tc©ÕtøçÕQ¬\^XÓ°Û ³¿¶)ÊPý& ±F©ïÃüà^ÜMtʳgǨ6¯Ýûäm'gå5E<TF ÉS-àì Zðý1ëpÃúùÃ¥×ú8Á =lä¶.ÝðhØxÀÈÑ'¬}!7¬1%z®äSæ¼l+â*¼Â ¶Dqµµð8ã¶`mGef¢l"'©®NúpØÃÉámà§aåØâ¡üfò¨n´³n_çxÑL4 × è )?ÏG ¯/è}¿,\ 1dÎYBz9>R¯6çgõÄáhln pßE^Z»: N¿''yÍèó6Öâ7÷1Ã`'NÃÛôÄÕJá¾þ¿¦H ^×7çIï (6 \²ÝÒ+Á~ cB]]Ý Ó¦¢x1p*µ;aè8 måØý.ÀBñG7ÇR'Y i˽»À(G?Ö*ÃÔg,ªâõ§¼Á ©×ÆYÒ8|:ÍA¨¶Y/`¡ ¶þN 5 H¯Z0ÂT<¦ò"/ Aê;C¡Ò {ûúÁ"`5CÎirzæ öÌ£SFÏ~Æ é $'ÑÏvñÂyuña°k þ¦ ê¢ÉÓGýçÖi+i»÷ò~ÙÖí À(Àd¿oü0 3Iáðñª¡«¢;Ou¹ _F¸ºÞøÁK'-^8¯+ÿ Ièrøç¼ìPÙk>Çÿ Íä¦b l ìY_Èÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg&size=160 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/6.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=2 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 11465 |
| Response Body - size: 11,465 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ å ¬×5æê{¬N=yT_S$ ¢Õ+kËô¨¼\±ÒnriËýÛfë fy»[._&º~vÇõåÉY,o¯Ì îËççÅØün3Lí¸KÇ/÷¬ÂÞ'XŸ{ XÛ"Jjo ±xÜÕ£h½ûÜ¡Ý ùs:ǼÛtÌ^ó6ÇͳåÒý¹~ñÓ-F··o%T K¯Ú#ù:ÔVÝI,dcYGúYï¯HôÜ¡"õ ê;G Êùz÷t½ËÁÖ¼DßJ¥@ßkªÑkÛ~g1®JÆé9 £IÊ!MMèréNÈ>Ò=ùnÁÞzçZ×z%Î;ðKïò Lì<J%û¶Ï®òÛ¸JÕ6_\ØþãynæOk·åÑoùjé´ûMáç¾òͶäì]«õcmä-MîS{ÜãAä_Kq{-@{x Wná]_ÃèÎæuɼj%ÃÉ?ÌNWª°,e±LÏlÌ£ËåZ(ÇT-]§È³zý+MØ325 OϺ¯õØvë¥^X ²ëUÒzóζo¯=ÇkõÆé7¦åä>DÃÉbrÖâȪ«W|© l;Úo±dVµù«Åÿ =e8r¥tÚ¾=Ö*Ú77LÒa Üyï¹[# +J¶]iYë7Ïxý;6ÇÍz>ÕoÞD= F¹{ãêEé¶zC*åîá¦Ö²0y&ËÕ«5®Xj Ô©=þP û_è¼mYO x}Y{/cl&L$B¯ûÝ]vÞvòcÎ̶Ií5æ IZkÚ«Z÷y|µK³ =ª®íoÂìÍMקg98À§_Æâ½nmþö»îVÂa/Åô1°êÈu+Üâ_&ñw¬öä Å7P÷)é0y> ²zu=" |ïÅU) fóç=ñ:ÙBð ÿÄ + !"@#01 3$2PAÿÚ ø:8DºW¸Â¿âZéÃ+J ¹T\« ß?¼p2^mçíÈv+®>®W¶iøñÜÎ2¨Ó&³ð¥MCìãÛWú~àÓí`+¥f{éëÍmE>óã[ Ð1\]jÖ<¶ö¶§qM±¸]ié6\.s ¹R²TÁD.5¶¤`W¹_R£¯lw'MØÅõV±"¾ÐVÈGGi²¢ &&½ñǸ}<ÄÍÝ/²ÃµtIé? K&¬±Ó&® Õ¬H7/"ÅqFé¶ ¬$&b<DÑ®©<7ßÚ¥ÇÂÒ'ql0cévB2¢$ÈÛÈT ~«> pP+Äø?îõÔìì^¢C¼dÒü¿O¢É b 5ñã A r IwEÌQÉANcø;> ÔýC¦z´ÌHÍy"ÂÐVOâ/ȦóS¹»=6ø "\«ÊæåPõÎZ (0ÅHõPxhúr/àøÊsþ±_E ³Ó}Â"fß°ºN¡oé®-³ ѯyâà8tÝT¦Á'+ÚêßSç9¸%á©ñ=¿®ôQR#º-øä{:úÃ?ÒäíuvÛi·ou°Ò¢8ÏtüÔîÞs £ÛYóM à¢`AÔV7?é»íÉCg% ¦iMß :`Qo ̤·=¾"ûÈÝò ¢sF½ÅÌjé>®Ù+g粧¹ï¤ùµzó<K9ñpm_^Ü!;Iã¹a¡£ à¨ÇõEAZi÷A¨èfÍ¥\í\îx¶0G+©YMÀÍZ7lÔÄL[Ü£ñÿ ð=ñ3MP<-´sõ éù@¤ )A7R®Ýq ¥ôóÀ;By©·Ôø¡ÅOÇKf|O$RÙæ㪠2ñç·-ý~«¤ºÃòÙÜJ׺ýc·=Äé.öWV[nI»NáÓ¿Ñ_×ä¿Sí=Py£P,æc4ÊÌ®ø5ón+TÕ8]ÏÁÓîùë¨ÌÜn¥å¶~Ê®Ê[Dë=¾¿u ©¸!¡ºÌèÎà¸ýÉLQ\Â/·Îº_ fD´[l®Ð*«2ÿ öU>Â.ú¼w dà iE«ñ [Xøörw«<ÀŦ'33ñ>v"ò7 ¡bÜí¦}«÷YÛi/î¶{¢ð½=×L¸S9e A³S¹%]µ¤Ùøº+WÐÍéA`7äTx=¨dÑ LCpØg²Ö°RW0Sn3 èX\`·ûõòÜühH\Iª³Í{wf¤²N½ÛVw\DW* ¥ßnäù.<ÍÛxU~@-9aü}6öt,%dA%±S.éøçñ1ÿ :ÝÛí ÆÀ¤îÿ âé·ïRz«Æcàÿ ÿÄ # !01 AQ"@ÿÚ ?è~ÉFû±{øÌ Q%ñÖdQ=.lðÆÄèök*T4ò# LlS,lS$Äù% ×Tu)ö] ½² È^ÉÂùD4¯Øàhõó¨zÄ8ÞÕ²Ù½²,ÔWýtéÊÐö¦ìÆÐt' 5ïævJi"2Ì¡ì ø4VòV8µóRkdèøËd¬Hhq£râ×V±.J£!³ÉúgÎÓ×Ztd) vf?btìòväÄÉOüqCéÿÄ + !10A"Q #23@BaÿÚ ?ìK0±hQKÚýÞ³?>é{ãyòæÚ}]4ä.;oåO!nÕ=uiB¼ ò F%9ÃÁR;Êl^&q[ëµUWÐ*jÑ"æÖYY4®© "ëíý¢mÂk®W§Õt]gpP7ØìÍBù$Ë-) tNM¢<¡ÜÜÐVMùiøo)¦Åz}xgñI©®,7ÊÂÙ:Hp¸ýê© C-åGéÍ2Ô±[SÉôîS%s>¬í§4;!Á È@÷Xq~ÌÛJåz]^C¤îÍm%|©Æ$&ïE9ìéâ[¿´Ç¢Å× ¤5×QÔôä. Yz§7(ìк'âýñ**ÉéE3%aýÞÐábªáÅCIw`UMb T¼ßí A3ém¥8¹ÃñÂÞ-A§vWM©Ä4 wÂ×ò¬Ø ,TÔ· ®jÿ TÑu áµÑuþ)ÑÊx+Ú_ MIó v½J<à?ñr-ò>*6اB\.ÜMµ¸»Q§»6°ÄÝA¬þÛÛq)°ZáIc7u > £N,ÐØ ÜJ4Mît{©ãÊ ðå` ¿Êcqìÿ ÿÄ ; !1A"Qa 2@q¡ð0BR±ÁÑ#Pá3br$CñÿÚ ?ê.s0(Dn+cCHÎ?ekíI'<(òM¢H¡Eºiû<L£ ÎöiMT ³ Ø+Jp05ÍÊX ôݵ¼£Ð40^!ÂðÖ %?uܯ³¶£6ÞQ s ð¶«ÅKPOL:hȤȧW`vR©Í³hÍÚbyU³ðM-ɹ[«-Êê\õ¬y'sV Ò5¯ ¬1Å5Áùi¬¡ªßDXÖÝP©ÕOIÔg"\ Æmº@Hùí?í,³lvz©ÌK{Ù³ÃDÛW à¶Â¢¥e%« ¨ë¥´RÂéXwÓûQîràá ÌpÙ¿©Èp × ¥ ìR×(´i ó0¸lü< Þt7³!hܱT ÉöV Ó Ì6cÎ=ð6eÂÚ!Âs_§h?ÅÙán#0¦*°¸QrÎ æRéÃMú,Lç0æ¸v!oa £ûC¢e`ç`´´B ×W {1Gt£ëïCìÜC U]ÐÊcì Ó§Çòöèrï@Ù 6äÛFÿ UºqÔ áºU<Óc¾îYãoÝÃù®ñ@Ü;3É»zÄòK´¤-ába¦ìQc;qNf}e¨Þ°3´ÕiµAÄ }£ZpjÒuíAögbÔx8 DöhvßTë3ÑuZxúªã¯2©³ÐtPW'jz*X*·°KÚd{ðæ'>ÑÝ-\ù,È Ë{8Åb`¸ ¼°øsß ¾.¡æ87=;V!Ä×Cëét|M½Í︷ Äx Ë §Ly©W*Ѳüû}}úº¬¡ìÐý¼ìÏAßçê¬DÖ Ó5ÊìL1h<ûQÑÍé3PTT*cÿ MâÆ¿Ô yÇVr±îú^Óܸ«"]¯"¨jØ}Ô ³ êÚÆÒ¾¼ú9¦Pe¤HáYé'o×aùë Õú^ fbѾ|´láÉÃQëÖjnå¬ÀfÑÓÛ:ì;©t.ò(ÎBz[ÂÒ6Pë8ó ×bÓ ý3»rÇdÏÓ.Ü ·³jÑGG¿6ÈÕªÎ3ÅõAq_eÊ7hD8oBÈifíâè5µÙôDëÿ W\¯#}Ä|ÕçÚXZ¶Zê¦Y²ÑLUrþÎßøîÏûOãß70lÌþ.ÔìJ d0¬Ã3vª- 2y±k8JÅñj.l|b??kâP<É¡¸åu0¸nÈ¢* 3ðñ~xr_³Å:ÍÔ y; ñü«ò+AïsÙ9 I;Í9¦âÐEÜ©ý3[2w0î3wxú¦ösK45 >·Pá !ã1yfµä ì+³éµmX´±Ç nô`@ÝÔ £2â jÑRwÿ ñælT]ÅURPɶ)קjóºZaDZL½´þ Ó³ÿ ½L! K;YíóDY44 Ã_EY§öß÷º&ÑÛÔ nÞ.ÚñX\xö¬*Óg&a¤y¬mqÞªIêÄ3£uõO5Lôív§÷®ô÷M4TRT®Q®Aã#X§e6ÓàuBiNÉÀ0a[}Ygý?5³¥B;½+èWöÅ ¬-Ý wEß)Xg£D?Á íÙêà¡hÚòiæ£uƼÔ`íBQÌç¼)³;':i´vN`³iKNÄ\zìí:9pÕÎ0sE;Ê깫H˾þ aÕMk{{E»!l Ù\ ÐrÅg]?)¶u ×yê_ÿÄ * !1AQaq¡±Ñð@Á 0áñPÿÚ ?!ûw38fXAÔ"oÏþ*àÚ TÛ&³¤½Òs´Vú'þaq¥Bè] @¶f: L× ½MqçÖj[ÉFMOxàgxWÓ 3÷кñ3ÑTÝ"êÚ \`¤QPF¸äk+¨kרsÒv Än0UFÍ%¬ o§ff?ì¢à §O·/äLÁ*Òi®#§BàùÇXî`0¼Kä7ᬹ1/ZÀ¢W Ý o§TZB½´© E¡Dx#dAøM@Òxu>Ù¤{.+êæ¨ 2\Lx@²§BA9IeH ³4twU§hP)¤ýÍ{³FaÀ ©w#øÌ ®0éìÊ8Q°øî §¬%ùGcoöö YW2¬5öÊÜõ[lÊÕuÃï´Ç¤{MP9MþvÚCÑ9 ¥ QÔÙÀ5ÑsPbe¦³ 8tÔâ`sáÖPEú*^³öö EÊQåíÇ\¢ÉÐ_ÙÖøèÊø¯´¸K7úÀ~e væ !Åq¤ªKe½ÏÜÄ»ÀòÓÒ.÷ã)É(ú*5 mXNÓ4÷ Ô´üChjF CW3<{öþCKF¸þìòHeñÒcj¨[Äë¹à·¤Ê&6fY"Õ1q=§³Zd6üW Vc©*XÉ°B;·ónCMR'ñ£o¶¹X¨]©Ì:S0ý#U(¤fö LñRÝÖ {ÂØ#Ö8 G¯ýþ×pF [8Q±wÞ¢±<Øo]ZixUÉSe!åV4{sÛ^.¢ Å)`y^C4Å, £/].Xc]ÑcßËéi©ÞFÎ ?]:âÿ ßãØG03 ²X½ê_MT$.Äáý> Pj_ÄÆnfàúÄ<o°ÓÜéON<<?¸Ò¶ÇÖõ¼§}üe½@¼lF½c-y¶}| }\ñàc£Â2¿s÷zÁ©jÛèb'Ìo _<N÷æé*×Gñ 8H`)î}7 ª¹iFË g«ý>t[R|xÃhFðÀ kGrZ½õ+{£ÇûÜB¸md`0[ÃÙÒ Á;|\ËR-¡a ÛÇ«EÕÀÃÓêµ/½ì <Èt¸Äl5 ½#Ä//púìí pÿ ·/¨éoó )ÉÎÄlÊøªÍiÔ@H#¢oô"¬J×Öâ³ê}oê?B0;T ë:û03 KòÉ«àîÝ Y\êÿ 0åjÃóËHîräÍü\ M¹Ëìló¿dh ,ïÕïá8ú,«·ßfPº c-ãJôÀ©õûfÔÌá®9óü,µ§gÑóý Q ÉìxÂ1w®Pí kB»¤×ì´mÍH4·UÜ&ÆqO^¡ôA¬M¯ÃIC68¹x}NøºL`ltO e¡©sã×µÂ!oUôÎáO? <pY£¬¬tÚü¿Ã¨¿¤ºÖ½xËuu7´©øW'â{ÃHáîÇz¿È¬e@Ù ìã<rØ2v5ü0òrté·§÷e{ùIsHmáª35^%ÅhÃ(NO7hè¯söóp¿F;FB!Hï*UÆÍ[ZWÒ¡Ø5qwäüÇÕÈiÖV= ×Ðj\Ò?Ad5Ç ïÏã è¼]¹é3Í éñÇ÷!Ö$¨3bª·¤FXÇBWÍîMEÞð£ç¢N~~b¶Æ/Ãûë F.Ñ:Æi9ënøùÒ5:¯ZL/è.¹ý <oÙ 1/ßÂÓà ãèÎ÷¹õ.öß}Þþaò²3,ë¿?5ÔU;çR, ªð6öÍú4ÉUJ4_ ·ö¿ËL~à,6Û&bW¢ qE8¢|¦!àÓÚ=s¹5¯<¦ÑÐß äßE¨»Ì£Q&cQAâ©! DSPU'Î4 ^IÑù¤3¦h¹tÝ}¬ÝvQwÔ º¸+CÒå¬JÕ:@Rô, Y8j¨ Ñ¡üA |È FZJvxñÌèêË»ïH¼oÒ à-f2ûDÄDz7 ¯Bh¿ä_¶µÛ]PuÉ\Rdâvõ%ÜÊ¡ÑêéÈÓ?'ÙªL¡#ð|´»~\Þ()zðô~d÷z¥H5G<³ÁM¸zJ©õ?0|;aB_Uá ÛZ}íûþeçUCÕù©í§6F; ùùÓ[C¬óØ~Ñŵ¶yv|^ÍY¡Ü²V>4Hà oëÝÍOù°ÝJ»Êa>aó§¡*äi ñ§Oû×3I·(@æ.\tzÞÑÔcÕÊ]dðf õí M%Ù zßXyZ}¶X6V³v¼ ø@²Ú=Ôî·´;Ìr áúòç ª*H(6ôÛÊZ]GLµÒA¡:2æÆQZgü>ÐÖÞ{ÞÏxKð_·«5;û¥¬³÷iPàñ µN®L.¦B¾?w00Äw D êÊ´üàªa.ë/xv%° ¿pÙ»îzz)Æ«¶ß§´Fë ¤C 6/ë¢ ðÿ à$S2Üì[7_ööñ"NÑ¡« ´« ¶Ýñ úhºeíôÒi×aÁV peù°}ÿÚ óÏ<óÏ<Æ/üóÏ<óÏ<óÎ2û¯à¿ÿ óÏ<óÏ<óÎI©Ýh¡tóÏ<óÏ<ð)Ù×,&Ì6vÿ ͼóÏ<ò7ëDj9ßþ~o¦óÏ<óÇäÌ\ÎB-!3óÏ<óÏ<æ ³JKG<óÏ<¹ä+]iPZnE¼óÏ<ðÃn¦³¥%ª¨£+|óÏ<óÏ<"¡Wu"òug¼óÏ<óÏ<æ$ü{¾Ï<óÏ<óÏ<òõÝ[Ï<óÏ<óÏ<óÏ<óÀ¾óÏ<óÏ<ÿÄ !10A Qa@ÿÚ ?ð.ÄÇù|òçc L9h¤#L`@:u Ù"NÅÆ.S÷ÄG!êÀq.ߤÚX@õð¸Ã²Láðúnc@!)o6N?/ê¯ÓÉ¿ÙNö+ÜÇ￬ àñk2CÕ®þ exH]ÛÝ#ÿ ¾Áì03 <[<° äþ]¤GF̧sîE¤ m ê 6óHORËÌ l ]OèXñ¹dûõ¶²-#9°-,rwcÌpzm8a}O{Ûâ}l°È[" Z \ énõk¾6ãñ`hÈåÔÏ9Ë®ù82÷ L9þ5SÖZïÿÄ ) !1AQað0q¡±ÁÑ áñ@ÿÚ ?ì¨é,íDÞ äYcEº#G ¼DE sú:OgTÌI¹£F{GrMGÆ:ÜRÖ nå;د O~É7ã2+hIJ:A«á2O]}ÁYG\P4Vâ¥î{!¾Á~ Ø ÐË.¿:IÞìs]ØÉåQ°àºë§Æм¸º|'¿÷÷©É8% íÁä÷Êñã58-L ×îCk_#IüÞx Î}ÛãéÚÎÖ9 ðvîÎòÔbâT¥1 Õ¨èõÇX%q5ïó3Ƚ? Ãç¯DâfA ò¸¥ôx'Uμùû8ÄiõØÝé{ ©~kí¤Aò߶¼&é³ Gj¥Ó¿o=>³.øÐSJ~ûï2è²ë÷ÕxÄ-'®½j *4àþ¹øLá¤yèìîL?5rÄXHâ8°BnôðçÄõ<#HêA þ&r*+Þ'̵°ôúö7FúÏ×Ì2l`Lä½ùubÆÅÝ/¿8À² ß Ê~å¥Î'¯â+¢\¤É0µÜ Ê£8W]tLW z HEڴ׿övHZ1PµÇG¯ W=&RnLãHSÒc¦Ý»ùAutHKi(ì ´ 8ÊJзå.·#Èí\½`Û´Q×,±¶ï êà*ñEÄq4BØÿ ÿÄ * !1AQaq@¡±Ñð 0ÁPñáÿÚ ?üc £ ûYkÜe+JqÈw6<a `^ vG-ëÿ ô¥_:L¦í¶«8®ÛÕ¼¦¸ÈsOBoX$©6(Ôx|å§C½kÃ`3 5Gÿ p ABeý8ä7Æ<½3í ÿ TÀ9\²ºP4vlÂ4mõðþóË8ûÏëÞÿ Èÿ |à «- çgt=oh]Âr=þ`ÁHÀ¼æýP!ö'©ì7eI©©§ÏÜ3¸H½÷ø¤å@èö½öLãRù>qJ46Ð]v ¨ ¨¸ zß5ÄÕ+OÛ¬¼jjÔù>·ñÔ! ÿ MÚÌZ ®, O{~¸)Dt× ë[;T hòü¹(NÂ3¯Y Iê÷íÓ¿¦R á³ 0Æ*xÁýüxp& »AËãöp1IôkëB'l\È:§&-8"áûîð³J×;>ücDlÂÜ]1¦ë6Õ¸UM?|c6¥uæ,8 -sº¯F¹ü³-Rs WÕ>r!Ä[ØÖÿ Q?¦_ì [xý?û$:í® $ÑàÃDDÐ[&ü fýJ#Èe>:Ö¦ÂJØx5Чê>#õÆ@±¬A!TþíßQ :Øò_êbùK¼&Áã¦G øQP¿Wì$møìDM8ÌEý^¼&& âèxÜþ`5ô"oÐ¯Ê iúÔð]² u¾*ë 75³W½ÆkÊQaa¯¥øyÍ=½@Eñÿ 1AFqÄÂ&ó ëÉä ¦í åAz#VÎÒµ$! W ¡>AÈäÞ)Û¯ v Ñùn5ë%ùÛá#õ<eôN2ÿ ìç¿8@EJ¼3P<ë4 0^ðùÛÎÅ"îGj®w«£ÞÚz26w®þúá7] Ãf®²_É(«K>ô ¯Æ«Q§8ù5¤ô} &7ÐHG± º TR>7Ó õI _N dÞZírxüÿ 9fón![uMÙÖÞ|}.Jó® 7M` <M°7ÄH>WìY$wèÌdh~²ßÖE¦ãÙÔÉQ±ÛÇVÙiD=Iüà*ÍqÀFrÖè¿|sþ>ó û"+=ö#ŧ8Ü88 ÄÁèoq°íÜاÌ˦HÑwç4Oa»è 5X¯ßHö#Þ Ï¨i{ýp4cGȱ ±)X'1AÂ* ¶P¹¥µ¾ÛßÏý ³&Êp§®ÍyÆU;ó¨L ALØ1äX{rà À7ß\±>åéÿ %·ü®:o6L6>áìûw»MAY§£È]Øljt ë+Ñ ¢ø0` R *øAÞõ ¾]ö:Ízʪy%Ñï·¿/ö%ª"pë £©ÕdǶ5Õ¨«i׫TÄÐEî#Å)GÒd)É^µ«|n)iHDu¤MXóc Û¸ÐÀýC zæ-Lé¾·O¼Õz>|`(uϬA;¾Giá{8yÓj$zgý¾áø-1*¨*ÖÄUMùR âcRöØóþ; Qûbó¤¢SñöK:úây ï>|óç lÐ$:lú!Zy8@|°¿hðÓß) §CÈts47 £È Ro]ç=FÆ»wþç $¬ýû`ùÐ3Èèh®ß L¬Ö h6NuÂt átî ªÅÙjV¬ßF+qãÞñ:£Gn¸+m=~µõÂ.ÓHðå¨õãðJ< K¥Fø^#\'KÜà oI %?%뫵àQÎseeTÛØ¯Þ Ô ÔÁNlì§O5Lmöùx?;÷ &Hã`ÑÊàñ{?¼ï °TS iKFÂÿ ¾]¢¬ÙÀðq/@¦ CÒüÜ>xFÇ L i*ÔUND×`-½MúCBrñ.+Âr>Ggxoðb3n%(Q*Ùà 1fÜ0ié^àmløÀæ§ýOü @C£÷ õÆÙÎRH« [`®¼{Ä>ññh ô61äãDyHk÷rS¤¤=ÅTcã#/XGë:Ð °"»UÚò \ßÁêu) 6ã7¡^'~GJ_Lò`mTí EYB1wK>°¸1À9aFÛòV%pdâ!(ìÑ6''²Q³H">ÀýsEO¤)ò:q u± ¸VC$h A¨-ý£õÈ÷Vü ýÃÀøëøúa 9 P\ò×" Âü3R¦ÅÙñqE¼ôÁ= tW3e²'ÈìÇ `°^Å|¸(pÿ G»Ùß[ 8Y(ã{,êYöî ¥ZàFª4[%! AE Æ~CFв2°§XQî : ÞQÑÙ@^JiÐüÐW\Á¥1ý¡ç¥Öw¥ Ô7ÈÄðû/HÀðº-£` D#ßá%X¸:- 1tå69&µ*ÍÌõø(êYÈ7âk/xCsiS³Á6?|nקC×Ù±ï *hç)>¸¥7ygr8ìÆ ð\÷A Óé:¸gÆ^ÓÁùN>í· >§Èd D¯ K3Ú"5yÒÑÐéq5ÙD ©×fͤkO.[/ûÀ1ÆDU×0tjÞ?_¾-%$+¥ 2ñÄpõ¯òu8Ý~N ±^öKÐnV#½ '¥Å:aè "vc8Å{:Q®0±°½§½ððíø¦þ_Ö?\ xc£Cföö£4{ÄTc(ǬBÓ_°ò ÷ë¥y<!ºy23y´$ØZ{Õ¡¢c÷\Jè©6jr 5£þÑ®§Ù,%ÓUy×˵«|M[Ûiüâ®jõ)§àßÕÄ ½éDù³Õeo³|vþs 2vT)µäª,Óéw!þ 95ìw÷G>Ì"YBE£rù5Õü )Ý·É:{BÉH)ðÒ{1_ò¨ ]ÎO¨§×u¼³|&ó]ëYNÈùÊeªSáxbð誳¡iD£ñÎô I<ø>¡ÆuÙ8û¸ .°Ì3IØ7%.F»^³$DÙi) R¨(&êÁÆÔ©Uá¨6û8»gÑäÎ%(ûñÇ(vº ¦Z]xçð I¯5¿¹xéãMÒà ½nç ³gî}Mý2#ÓÀ;ºÕà ` K FÄ{x.ªTç Hûüw[ÉõÁA,LÙIðÇñ1Ø<¯ÎT¸Ò#^¿Î*ªlr*WË-?#´æ;:¸4 8ÃfQXO O¼WÓ°¹?½L`"%`8+âßY-Ôìår>F aÎBJÝuÄÁ® èl÷þÕ¨µ þ&H¤äjº`Ûûñí`¨`y MñX-ãõÏbÿ » !¡AÀ¨aÆä\"Ò1À2tññõ9$¯IÁ ß6\J IýÆzL-¤4ë ðµ®B:gX Bð=sý÷GéV¥.Î>q¢ìÅ>áÖÓCåÖöªÖ÷ û]¯É¼@¥ÀÆA;®`U] Û Ydß!D!eàâ.¿ùGCõþk=xÎ 5rAü bòõ ÇÔ$Êä ª9kr¨çoßùÊÎOyð[Þ"X¯üï¼tc©ÕtøçÕQ¬\^XÓ°Û ³¿¶)ÊPý& ±F©ïÃüà^ÜMtʳgǨ6¯Ýûäm'gå5E<TF ÉS-àì Zðý1ëpÃúùÃ¥×ú8Á =lä¶.ÝðhØxÀÈÑ'¬}!7¬1%z®äSæ¼l+â*¼Â ¶Dqµµð8ã¶`mGef¢l"'©®NúpØÃÉámà§aåØâ¡üfò¨n´³n_çxÑL4 × è )?ÏG ¯/è}¿,\ 1dÎYBz9>R¯6çgõÄáhln pßE^Z»: N¿''yÍèó6Öâ7÷1Ã`'NÃÛôÄÕJá¾þ¿¦H ^×7çIï (6 \²ÝÒ+Á~ cB]]Ý Ó¦¢x1p*µ;aè8 måØý.ÀBñG7ÇR'Y i˽»À(G?Ö*ÃÔg,ªâõ§¼Á ©×ÆYÒ8|:ÍA¨¶Y/`¡ ¶þN 5 H¯Z0ÂT<¦ò"/ Aê;C¡Ò {ûúÁ"`5CÎirzæ öÌ£SFÏ~Æ é $'ÑÏvñÂyuña°k þ¦ ê¢ÉÓGýçÖi+i»÷ò~ÙÖí À(Àd¿oü0 3Iáðñª¡«¢;Ou¹ _F¸ºÞøÁK'-^8¯+ÿ Ièrøç¼ìPÙk>Çÿ Íä¦b l ìY_Èÿ ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 334 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 19219 |
| Response Body - size: 19,219 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ¾¡ñ¢j4ëÝ1«j(: "N HN ZZ2íVöû·£Æ£*$ ,A£e¯Ë$«s4°óÛJno¥ËiªH*è wÇ7¼ÏÅÜÆXî}Î7©Û Å5[9ÕkyÝÍnæDèÓL¨ÚH2²r>¿>¥íݼÍv $V®á¨:¢ `NËGRªoDíS¤=}×DâÖÈ0r"HR·^ºâjå±c½ÔÆa`ï$Øm K5ÍísyÞ¿¾½ü;$ ¬´§Ø9Æ2Õ©gpâ v ×6v·?¯¹Í}ì{¹ïªúP0U§^,ÜõÞ\÷ß+qÆäXºãµÛ ÐCs#AÊ~¸ANÄfNååô¢±ÇÝ˪µ¯WÈÎ]¡Bék/*U'c«r*ëË/AQköiçÓWÒ,+jV½G|uq²¢v`g÷äÏça\Ê¿èTw¼¢$U²Ñ`ïTÀÎoHçÓz WÃfÛ·J7þcMغri H"¶tcãå Ñ×Hj]=òó7qi¥«Òù_EæÓö5 e6?©cmpXP·wÑ,ôq£Ï è_Z·sù¼ ´xÒE¥2wÛ9º úôtdëzÎÅ4«öD' lèÐål´PK1æ¨ ]l³Üù¦zÎe"äì<߯½ü¯cFÛ :VÖøg×>[ú4 nã´ÍWô:8Üí,të·UÑÏy×X¶ÉÊÄzF³¯kIÑ£yfS¹6ÊJN¥[F§oO/I1«Võji¹è\GmçØZÌØâ ÒÄR{Ï ¶ØB*¤S3B ºÎjÿ qB÷Ë®êfj2OnXe 4í$ÕÖ |ic¶8åoF¤Í ±WX` ȼô±*9jÖ¡íy/\þÓêà Þm£wô*º%κjuoæ}Íîc§@ãImq o'C9À6g[nÚ¾dc{TÅЪ¹µ]Lm9qõÞbÙ[ ^vÛhXÏi X;Úi.` -R¹G ÷¹GÁRsû¯?ìÂÛZ&UË´8ÍÌcñ¯-HÞ-Ò V×;Wcç[rÜ_¡pûÒK0_z¢ÔÕ¦-}+¾ùJƶq4 ;?B¨¦¬ØÓ.µ$\P£®±£BSÂl2VÀ½Ìk©cë>QèjÉ[ïçÇïF¶µåÌîXªmbôÖ3ï3Ôù8jÇÏEÖ'T´ô ÖiÈ`7 BÆ6µ>Mò°â°> é^kËè6ѳᤫYÚý Ïï0à궻Q-C¡nH_Ç]÷Ï=)mÈí®bÛ h<ÙÒÇhVÍLÐøt ü Ü U }´l@¶qÔ §t?¹Ð'r|X1´è ]|² p3ºð ú{ D2¿=ÄyåÊÂÿÄ * !0 "1#$2@CPÿÚ ü.ê¿ùëãÃw~@[PZ7vï÷áÜmZ[ZYYWÛq>7bi_ATßÕs-Ê%ZüçÝÑUnØünÑC«°,oãsZ·U¯ºå¥ }¤UQ¬ù-shD~ï¨ÛC /ãs´ßãq¢4=t¬RaJû®ãíƯ údÙ½~güu@6¯"®{:¹¿Ç$ÿ Oíc`¯½ð²µåãtQÑææᶪæý.ÈëØ9æÛ Ö ²» Âêf×î.¥OsPT [F#Î÷ôäÔ$/ãÆ ÎõPÝÖü _²Ù¸Më(·.á G TÀ: ÎOåÉ~´AÔöë«hP°Jº-Õ72/¾F2 CôÜeV;ù,¶±Jc÷÷»¾ÎQZ_µVS¹ §¦Æóò¸êGF´ò¨ ØWÊ/®êXÂHÝt]hrrâÈËãÉw²<2)½áÜahxFU 1ü¥Õ×æƱìÅ̼Kð3Bq?õû.\hQQmu.7?òl/nBkunÀNÀ´ ggXÿ Fÿ ;5 ¨×]óÀC;¥\kèÝ o¯Ñrý. eÕ³ ئâYò<gºg( þÞêw(V'$h÷pÓ V AòV÷.á\it;ÊdÒò Zê6ZÐCâ¿+ô¿K ãvÆÆã8ñßÇg·± Å`¨Qþ&ê:¼Æÿ TÊ3¤z¸ª f ûF^ÄÜÛ6³öã1®åÄE`Æ2ÛK^/Ä_Múñ¿! lèüWUañ˸¼ÜF}Q-ðÙFóu ðð°lßΪæý·Z*1eåâ4?# ÇM³jÌc(_mjî ¯ªåÆÆ©£Z¹¨¯*òhbïÆÂþàd+b´Ø]vw·³¿KUq OÝËdØñy&ì|± òd*Öò[ò¼M!(*ôÜÜÜíøoÒåË.£tkÜë |vãq18am£!ÌGÅ¢ô¸pÆ£>'kbr ª»TPÐÕzoÔ®-¶· ÕÍþ7.(P¥Ïç@Ì6qêN&Md=|rµÙ®2ñ¦ÎËspÙ«ï¸Ã¦8o?nm=?&²)£v+ð"Õ @õ_î¼[¯MÍú_¥Â.Ë: rÊú¬\QYr¥íä¢ø¢s+ælàâ9ÜÐÀ§ r~é ÀÇY1abÆöÆ¢øÂeÓòyËJ¹¹¹¹¹¹¸W< cßp®Y N¹Ç!êÄ`²®©¦Ó,ÙþtÚ³´í 0j/0ñYÁ5Íkk<Í,H_°Ô^ù^]£æ ʹ¹¸ÒýDî¯sp¦=wuyÉMð3i7#É´.AÝ»8 ¬ LMÙ@²»6PÎc òo§y¼¦-Vp V±ø\9úÓ}([[¶ÐÐëq¿Æ³³¼ÕCÛrî ôݧ;!FlA6 ÂË#|¥B4æ_ëkäÐ}³±}ªðnwý·Á õÁÌGc4ãk1]£È¿íJr¯Öî\`ÑKXy±-m- ]Ê?¬[-×iw *«Ê^Awø¾'(ʲ²O®&u ÷"Ì 33 XüxO(T3ÿ BúYpøñräZ²d*æçiGóëráÁÉjesøìp2få~æfä3 ¯ä1ëôSwrîXyÅâ0 4µß·N?ºgüÎe?'²V.e¹jÑ @¢áÇCí°²!¸»ÝÕÍÍPãõESsrå¸"Ò. Ìò¥,ËÊw{s\7ujȧës:ïÒæN1ë Nªÿ ^i933*Ünwxw¾8üP~fy§?Îì%Ë]îGÄ¥ãb`[ró«P âPÖå|ÜÜÜ»DÂòn°ñ]ËɬXÕùPî2ÆÆøR¿6^H¬2ÈÝÁ+âX.ãEy9*,á¬Ó t ä±Øöåcx©UUOÿÄ + !1" A02QBqÁñÿÚ ?¹s(_ú/érþ£³S.ÆŨÈWÏìȵbo`LUóö=0dsÄz /Ý}=̺Çù ú_}ÏJT6È;s6Goûñ 'å=/ÚºO3{Vù åJ1ôft;|JSô»üN?_MÊûuæfÕÉÈüaBÀ.W£ö éì0lg¨`£paf4&¾oMåÆ YjÀÆC 3g ãø¨»,fnjõ55\?!3räyùûQ¨ÄßR¼2¦ Ц¸Å\ ìy¤#!iXãj3]®CÄ°E´¬|ýî¨~Bæ®×º8¼ÛÈØW¡Bç©cß`cb¦ÄÔfg¸Ç¸ÚÀÜÇQÉ2?D[3>¯²@úÇ/3K^¸ÍÜMdÀÚj[ó3æ|¿Ìý¢ká9MLÇüüCµuQ2|. &` ¹Â±z°^âøW§ BìC7°Ù¶n¦E£*T©PD5?U »ðãÅb½õ1õæPêRsiÆ&6æº7ÇBl¹3??òTÇ ÄÚÔãd2¥A,@f*±%õ?°fÆ·% ±QqàÂb \Db îläöÇBfØg^&*zv?ºÜcá8Í«=P2ÌXY!@@¨O7s5þ#kün¦,Có0 ©þf|àÆÕËí5Á®¹ûeÔ( ÌjQ® q±ó YÙz Jó¹K±k Ö¡"ª{?Çêd¶±uæl\¥EYt'¶ äg³Os ª¯S:ÛOjùx¬$(îsùBHz Ï Ìñö Ì£õ*fcU ¹SUC5©ù©ü4 âÿ ßýL±¾æ^§ÿÄ 1 !1 "Að2¡0Qq#a±ÁÑñÿÚ ?ìÝæÛú5Ø C@Aý+q¤µ®@Çô5ûUrûGÊñà=8h|ãÃñÀmsÁT<£ÆÙñ.óf[éüÍ3«/qànD¤(müs;ñÆ=f{uµ±Ç¤KÓ¸g ±;å(ÐÞl Ä.-³jäNðct̷̸馸!éé4öóà¾é¶iun5¼ÔÞ0bc _ £!ûÊÎ ¿G¼}F7Í Ê·#óµ @ UÂÅÜ%õ°ÎÃÍmÚç¥(Ájèf«HïN14-Ä^íÉ E°7O F Ô q^ó*%ÎÜmÆfË u¬r{IUÂÑm¾OI®pWvéðÇDMÂ%é«;z]I_Ò<VÙ°f[xuþäÄÑ`Üæ_¥ÍÀt·VÅenúbWøÌ:öªcPËËþa·Wõ,6¾;¦÷ïíIfÓ´ñ47¾Uæ)ñ4õ©È Û5` Íc ð2eM½¿oÏù1Ú¿y\t:*õ ·f¥¬bW·ÒÆp%îPzx 1¸1>S5:]°ncm ùûM6¯k8ù ËQ·nS5fÕnôµ±+ÔMfß1o´® Fܽ÷Åg¤MÌ&%ÆåÁyU¥Öþ²C+²Øf¯vyäF^ïnà >GÝnäÅÔùöæZçÒk/ry@p¿Lªµê º»ÕÛ,Ô>7%zì@ôæ1ò¸¬ý °ejç$MF¼o/úDn _còG÷ ½}ÿ 0é =ÿ Ü èûg ÿ ò.¸ )Nõ÷ïß¿Þ ©jÒ¾²«7®faFx55-ÜpfµígÆfá99ò\¬²á§¨ å ÄªÔ Ùûû1é&¬ ° S0PþÓûO¬ØÜEþ ¢ôGïlbÞ2-ëÍ[¨²úMe¬µfiýæb²Á¹ÿ ãóQ5CÈL¼#øÿ sHæÛ¶·¨;6ÉIÝÖÿÄ : !1"AQa 02q#¡ðBR±Á@rÑáñ3b$4PÿÚ ?îgÿ ëü± Ü9ÿ !¾`°¶ð¼A(t[6úåfûNÞº8+"<rKAVQp§/3¤«ñüüǧ0Fº *#yÖó?]#ùvÂcí÷,2éåÅXǶ9µ ÓÀ![x/Üx2Dg ï|½¦ `ê¯=FOª§hUg=µS duãôQøxx&ÝU{ Îë]¡û?^¾åôÂ%¢×îN3 ¢ÀZzøäΤ ã2:î;:ürF>¿ºc ölîØ7LdXÛgbV§ ðë83ßph¹ÜÚÿ vâòÞþ¢ËK}c/ºé3û.ùT·NãG3 æÜÙ pÙ{*ù5À~?E³°RÉÝ º¸yf5âëÞwâ¿Ðj*ÝwËLÂP' 'i>ëd'Z÷JmRØâ¡ûÌkþÔ¢Ê ÜùÂ=0¸÷2ù~±0Þ^1Ð Àò÷7SË Ï!PÕÌóçöMÉ -Õ 3ØÖ Êb0·|<£h ÃT6Ö7-áõXǯU6´W¼µÀÛ¿lÊ5(Ú]ºiçÉV©RÁ³Þß;¾ÛC¦8ýxê±ks¯ß>×κ´ýýá L@^NJ Û2°÷þ¢sA9#4hìäg<|âV9Ôj7%墻¢##$¨q®ÍÃ0wÇ1âÁì<6Ó{[Ã@ìôûÕÕ¦+RÌSkU?á©»!ÆO *±m;«ÜÐ1)®$Hok ôU¦¥B&÷ÕS}£8'6« 8Z±§àZ'S\Àn÷ ãÕMÒw´}B.×â¶ÞÐò×4\Ú|_ÑS¡¾fòÉáÏD1 9(v$i"Usí/$Í2*bÚntV:ãXê=U9\.2{ }íaë¢eJmptúª´j=Ì:OÁ$uð¹ .·þÅ2HFpGtì:O)RÙ3'_Íxth }P}7Ò ßºg]U:t8cDj±íHTÍP÷Õk-§¿Úz({EìqÆ?Òx£L[¤Ýõì.c ZÀw$è¢{KmTÁ¬ËðD3¦h{vÏr¨ó+ÏJw`àã¶LrñìoÏ¢-ö}÷?ÌíAôÞæÙ?t¸\5ZÇ#!°»{¤KOÍRo¼==ëU.Æîºÿ nÊ Ú%²3ǹ¼D&ºñ$ #°D6ìº[y~«hÀE¹ÔÚÖâ]® ¶Q°ó \ê¾ÚP 5 ¿U _{væSJ`T8x8Þ 0·xàölhCoÖ5+kE̵°ÙcÕIt¥=¯uØ»° îH²Î¡æ9OÍnd N»tsÓ¹ö $ Â-ÿõSB¥7ùµÿ Aî¼3£Q÷ú*Û>ß3%§yløLªsKörw±õ ïö'7Ú+]Ã:'Ôtß? Æ©»çt!q.}¬{XíÒåúöØ èRÛ÷Q Ó àâây¼ҵÜÓÉ´¸âÓÝʪ:ÍM:ü¿T0좶³ýéòܶÅÎyÑÃ%¥ìÏ e>£% ÉcôTöu)Ó:<ê9 qRÂtà2·Ìäa $Ï´NpÚ:ñÇDú;XQ1(¹Õ=ÿ D Õ6«ÉÃV¿õM§\[v¼¥lö6È ¨Ã`.}¡ó -|QuÑÿ ]T¼ÿ ãÏü£"ô÷LDáÐu_ûFÆ*@wÅH$pRpÞóîüb8fZòbõ ÝÞØçÃã趮¨ëGáhm¹ß ÇdHïºDÂuzÛ´F ¿OÆ © 5²mä¬è ÞýUùêîvàÊpi qåàxjÖ`nkhÖ Âp8½®ÍÛ[wµ ÒÚXAÌˬÀHÎRe[êió⦤ÖCÌü¹)3¦æ±.Ü> TmSå6·ÓónæÏhi0u mZ.¹üGÜ¢$:(g¬ÆfZ2YS}Íäc+òõäe¯.Çt÷FØ.ø&3ÈGrÅï4fìôN/¹×béÑ ó*lªóc ôMö¡å©Ãy ðï [fª c 2³éÊkè{¦w6˧öãÁlÜÇ 24Ò3$ykLÁÈÆ«dlk@Ъ+X qSl¦ÊµÌlãEL ÎØ5 Nó©º A¬Qu ®ØZ^Áu§"e²-'ª}IÂæ»GZuùGZì6 µÏåþ4PüªÕIí:|B©Q²iÌóTö hB$º_ùÿ ÍS÷Îóʤʣx¶A-á÷)ΧçäÚh$ñM± z'C`©NkHoÁ7½SX*4æ9&lMÃ%Î 8D Öá1æÜ7xö[¨ÔOÏtÐûaÏn0kxÚàÞ ¾ÑRô5ë¢÷ta Ù3× àt¸j²ÌCZmpý¾©îÖÓç|4BTÆ?ç¨_ÄÕ4 Á¹!ËX ÏsÞÒsú¹ÙÌ«º \Zà?äåþ>H8¹» @Ô¢Ò 7 "ÓæiÝ(2Ð<õV¼gΫF¨Þ ªQ£AÆóù ºèíKG4Ê©¾5# 4Ï~ÆÄcªÙ¸ËGôqïÓÜCë£ÚÚpdÀþ^¥O+i7#Áj2y Û^ÀDÜ[Ð}¬DGßúVµ oq=;0'µ¬Ù1%KÚßépÊ-"3¢ àúx¿/dá>ÖÓ/Éûê³- ÍçSþ&ç541 ¦myð4BCf7ã#æª2Ïví øpûÑC[å7 þ\Â$ "ÚNàS:ÑÖ; gµÅ¢mê:YJ«qaÕÇpÜÞ}ÿ sIÏ?ÑwÞ¨ ¯u @ Ñ@T.uÎR«)0F9rìWNû=óð-'Oì®ã~]Ýß $F§öçØö¼eÞSÈÊkZt<Ó`Eã «:ýåSÖé$e]§ªb,ëQÛ±Ë=4T¨û5+0^x©eGT`?1Ñ n$Ô3÷Õ=u73_kç L yõp2£ØÁ¹ÎѪêθöÆo¼Á/CÍoeLgºXþHøËèþ ÝTÅw<qj© ËÓ2^N¿sC't¢ D4È í²Ýâ¥ÇúöKL±}&þ1?Ùp¸+]]òÂ,tÂk;1¬è7äpÞ?D ÏÿÄ ) ! 1AQaq¡ð ±ÁÑá0ñ@ÿÚ ?!ýJWÿ À±ú§þ+ú !$IãªßÍý?÷g% ýÌbBIB#vÊà¨p×ûì`þ¹ôUÇôØÅ´»ßý~ø:¶Â2w®WÇáÿ WÐÒcÙ ¤9 ޣˬ¤,F¿ÝoX§'ôO¨2Àääú¬þ Tâ 2-'ÈK&sÌÍÎBÿ g\Xp`s& !£nökyk~⥲O |¦ qX?®KRMÈç4C;ú¾¦NõqcôO"\cdöb ]®R×Î@¨!îsÇÓ56ÁQ_õq P]a+Bt<½ uÖ|[Ô/Î@ÎÊ:×ô}1V999>Ä+;`&j|*+8÷äf$¿P+¸ö¶÷Æ2ÏCÝÏOa2HÓÐÑË>äXĽl,3³ Q rÈ£ !dÚÙíh | $ÉÉÇYh`¿ißO>Äj21CDÚ-PMÆ,=ÑɨÚKúDÿ <û¿C"s$ P6{íO,ù>H£x|=}7Éá!ÜuW8tô8P¶_W}d¾ ïðÎD?eO¹ûb$«åX{'N.iÒðà09 EÚþíÁ¡ÃxÁ¦a@ 5¿ãM&*|üa ,nQ # `%ýqI,ë':L[xÊÈ}zràãwÅÜmý°Ð)Xú 8¡ûå*]{Yñ.ÁÆ Ý-Á9'7 ¡H×M óÿ ¸Dv~!¥àýðp+o'] q;5VÑcH¢'l ã~Bº$r¶å ¡Ç ã# 1°Ô ªÒu>s&(ZMILVÂ¥S×¾kEÚ·Ùã#gv¸zO¤ú¸ë)Ò2K4§ w'¹. ~Gì0½§No¢ÌØé0¾Q8I êê(ær½Ü4hI ¾øÁF@+q#öɾ[mÉóíQ4CQ ,8£8³¹)5ÈöiÂàÔËÖôÍy òQ'h19 Ê ¼@ßõ #-{!Ç_à?¡Ç ç ÜK]vÜUQ×ð C)Ûmßq8VRoçóíz+(ÜöÄNËÃZ²¾?פÄ7Ä#< 0±DºÏe§ô¼*·µp¯El<u;Âölà"7ô®å8$ ÷ ÁqËÙq°\vÇÍOÂG"}Y»áÙñK§ÓËs¨q¹¼·ÞDÅ Éôÿ %2YRý?K(PNrС|ÁÆ[¹ÑkunSTh¡÷DsI@ WFvdõI¦ ¶Þ3áë'''''Õôwð`Ál³-HÄbA)¾rgCNËu¨ ºxxë ³`ó¼¤ lFýÄøÖNÞCðNKVf¥Ñmd .gÇ/ û´×ÆB@± ü¼Ïé''Òcøe}îÚ²üå\ó1ÛQrÿ u?é¯%(KÖ F(JÜK^ ÂÐ øic¬× 9Mà^¦"xb!4 $øó£ÚÆfÓJuægÄ`)«ÝfòÑ]ù2·¾ø U¬¹Q$ûßÑÀÔtBsq"K¸-måç$QßOéÆfÀ7/ ùߤúM Á8(]ú*pf Û5çÏïã 2I9(?5#2¡'Ó³ÛPáÙäåyÁ$ÞJ©IHE¶Y5ö?r¦ûÑ E`ëÒrrKOM1G¦ PíI\çãqñ-Ln,ª¯¬îì(Ýç§ör&JV.gý÷[\vÍl§Å¯8Bª ηõÃ]µ¹0&FpG¿ìÇ!ËÛ©K ÈÄès»GíÖNNN&ªðÂaJ¸¹ºñÉ]áöÁ@} d2;©¸é 8Ù EíßX(DÜW:M?t_÷ ]í]OJ{ p©7cE]Ö¾3iúWÕc¬qÄZ¸cÄÏà\ ×> }ñMߥî?°}²@¤9,üý² FZ4Ûܾ+¬Ù¦®0X½503@ò·?ù6´òR¶>ºûä9¡TÓÜÎdItfBã(BÏ¿{rsиQ 0 ݧ¸ß¨©\@@`8¥rs|s ñppÚm× ¸ Z ù«'x»ÔÓ|óªY<ýqAä<è>´s #VÓÒ>xÈEPñ0HXgGµbÖ/YÉõ_EéH Nq&3¯$°ñÍ)âzñxÂ"äBç&<I{òà0r)ääË@f .¶þìÏüdKS$]ßËÇH''Çäb²¯g½Ä÷Äk¡g @rex KØòÀºu0ªäÿ 6ºÚ[ ÍorëßÙÊS7Ö%ß».O¾þù4öâá©üÖ Hi,B`¼Z?yâãxóbÔqnCÓÓHÁÆAíòLè 1sü¸F D Ð01Gbqãüǧ5£ãó47%àÉ¥ ij1&þ"2¢¦59nqqå¥áta&&¯ qU%A½i¨-úd Ë?À_Ê(¬4Cqro;Øã®ÃÆ2fú`q°ô)èø2±D,d²}ôß5Í3O@Þk&Ø%x3]6G<·SoSÎ2×°^ÑκÅ8 8ì§ØRs÷ÔoyDkÏ?lè¿ /£zrtx<2æªÏßøÄ2!Ð èøû̹va§Ùóç$ r":EÅ}'â²"5¹(3¨2 Ü{Í`Kcx f3ë6G8Ço ¼á©^£R(|VMFDÙ»Ö^¢Î(÷ô~.+ÍÍ&9Ý Úª·ë \{~?muIÁÁÎûÇÇë¹ëµñßv ¢_Û>¾ç9_¢nQ{8@,¢ªwßOÆAX«qQól ÕM?\nÌ_:æzþt -W÷.KvK}Á'«!ímAæp ËQäùq 4&ÏÎ?I}*ÆP7XO¿ ¼R \hõ0Çã 0ȼ` @±1¶ãë^S¼8ñcÍý{©h=8(P §ÃÉP8<°ÁÖÀ7¸ãëXÐ0lK ` Üÿ 9Kɨ`Ä,*¢KX7 {8âtÂN½A4íPú reÂN\ůd^7±H ¿Ó **3øáHS_äè$S I=²II·õºàÆK Ù1°äë RÚ=ÉMü1Õ JÎÿ =bôȵÞmf ~çr|9~q*É ÓB&L)ÔൠMÕdú$ìõ߶ ¤Òûc& ÈKs~\VttÅÄñÖóð$ ¯Ä]b»øT=ò)µÁ;Ö6O$q Áã_CtL}øÍ9 OÔ ¯-¾,*Ö FØ®Û}òh$@ûë)SYÇÖ~¹4OH}Èt@z\80à&)ÇN8¼¾uî´Í Laõ$#íÎL299Ç-bJ\UÛMª¶V¤wÞñ´ÉUéJlRG '8?{U|>Ùp³ùÀ¼ÃgØÄdJPcoûÖR"÷¹Åæûgqªq|´\>0U'aÆÞ9-Û'ôÄD æÛðòã@Ðv7 ²Màݶoóò¯àOx2 Ã+ý§ù^|b½µÖ~?ßlµgØpÑ|ÖJhÙ&È÷?ÑÂ0 yf¸ë$÷ÎÏ^×5ç DWÆ!Ï p5íò©ÉE=ß)³ÚxÁÐåX ¦$ÄæzÈá[r½U»ÍôS Ûõd&mO³æ~5s$µÙ.ñåvQ,xbj!åöÛ¤äfzUÙ¹4÷);ç;kÈÂa*|¾Às 5ÒPÑÖ%¡$Ø×F·IÆwFh|t{¹ Ç{·ôÄdOÂ|aSQu_¹:Ö!Õîo ¯ îç÷ OHÌrË`õêç7ÈTr 1¢! lxn@z {{9ÎJcËl/jGñ6v³ Шykç7(íÉàR'-ðª;l~%Ï 2ädY/8³¸4`=ðÃÀóu ¬\ì:ºâðiËÜu¾p+i;ñXÌü"! ½±â/´æw! ùÎ,¨bâ>l,Fìd»EW¹§nÖ'QóçÇ/$X\§ Pò÷õËÒ /× ÄT,¾Ï4ôm6Þ(äÀÒdiUîc) ÿ !rX§cô§v(<ÔG©Qu0]G¼± åF)YüXÐhD v×͹ï××êJþó`«'Ù;KÖH¥(uÛíJÐ]Sq{:sÎ ¬cH_ÒqQ#¬ò#ÉøelêÝüápRØB.§,»ìêâïa>Iþre6®sÛƽ³3U¹ùÞ*M¾ ~ÙÜâ"<¨wç! )ÄSÇõXlè*+ãX Ä@©.8z×0¨µE½ 2ÿ F©é·Iîc)+l éQ¼3 {VgãsîÆ¡+*J¸<<Er Eµ~ÿ ;& JeÅóá¬,"u&§ÌÎHË×(Rý¿b³Ê´9ãZ¯0Kf@ # û;ë/õÔ `¿ÅÓ¹ïÑ/]3ÝÀ ûþX'äaø~qeòpj¡9¤£Ç¶"á¥. oQ>ÛÀAJÍ8XÆpø'yH§'3ÿÚ É ë=¯ú?wÿ ÿ ÍÅûïÿ ÿ 2ÿ Ïþèýïã Óp¢rÀ£Ö<Òþr+ªÙÓ£ø$Á$¾½ðAíkQb Ìü:Ù*+×ßÚ®ðZt»º¤Z'9þÀ¨³UmwâQÄ4L¢Oúyp5ͲsKó_Yßo<»WÞ| :BF\þ,}+Hg=ÎZ¢öl5?ÜtP¿¥{ÍBìSɯh â8þýп~(öò/ÜÿÄ ' !1AQaqð¡±ÁÑñ áÿÚ ?i 4@ùé^ÒY)âZ¼NgÓ¯Hî.\¿ ¶²¬{ÌɾÓÎø_nê>8\(U pÛL{ÜIR D+AÒaà-ÀK©Êááztáëùã ýó.\¿7G `7 \¦:ñ;é7prÛ|(j\¸7¢¯sZ l@öé}eȱ Ûyúë ª uë-DTÍÉà` èo^oÊ [W= %IÌ-oͬ{Án4¨S \j¨k¿hÀY5u̸ÆC¬¼¯^¼¯hu m߯Ä((ë³ïrÆ·ëþÝÜ+çëç[qõãÏð8éZc<¹Lߨäã[p©¿]¾ù,Ç&Ý÷ôÍÒ_xQ^Þ*ç¯ßÆÒ2ÀW³ß9^àpBRL¸_6 kÁËßÖt#¾øGXk-o}+5þ&<J"\n(¬G¦¢ôå¤GÞ;ö÷Ô.¼âDA($:¡.F4±¥è9ï×¼Ê6V» `õçÄ!:Ýs¯ºøbÔ©VAMíûçå(׻㱮x_~¹&¼_®ñ±¬Ñ6sÐë¹o È@Þ36I%âæ eÑ¿ÜÊ¡W^_ õêô8ÿ Ía"&¯®1tïµKp1 Wä9ðdEF dö¾÷é;ø ¤u2LZbIn®:c]¯Ki¼' Ê{@ÜmZé¯íCß{ôGEÀ翬Ï/£wëÞ+Õù·àSä¥`ÎûÌÚk {ü3ÞÑ@µòîúKEÄªÚ ,]IÊéÿ aª_}±*ÞÁÒ-²¢ Ëpâa+1iM [ñ¦<ê"Ãô|:úó&¡å¯}ó²Cê 'ïRÈù?+»«¾ÿ ]2yµ¡Ý@ÄÛ·¿}eÙ ÎÒþ Ö 5 1en ÁP jÅ d ïïÝy2´+ó©§ µÑ¤¤ E[LüG\Öd¸ùFýe.ÖÊA¥¯F À¿Ù kóö عâ%|ÌÖÆ,CÌçÁÿ ¾ÿ ²¥\Ö ³ÿÄ ( ! 1AQaq¡ ±ÁÑðáñ0ÿÚ ?m ûÿ D8©áßÜç C¥|A ¦cßlè ïßEtÈúQàëW±ºóç¾æ ÈÚ½j®ýÞµàÑ;c£ >y8¾¢ 80µ1ü½5dÈ,L 1H2ä#E;п ð¬ï÷õÁÉÉÀÁ1Vf8Y%:i]GLz£úî[ÀÁ*ïÝbtâ7®ø$Å â .<Õf ã®øîN! y¼út®ød¨öøÿ 0[«s°(rX7 K=«& 3EM{äx$âá]úuiã"I®30tt9Ú~2¿ßIpfÉ<öô#¡=qYfnµ¨Ô]»««¹H¸µô/qXÐ=& ¾zõÙæ°Gy<GÇK¼à§PÉ W¤Ø»? ¼Õ Vfôòó ãË Æ7Å»¿JÂéÆÑÌ}&q£ 1ÇNÕ«D`ªÔ§XêÕå MÈby§¤ÎAk'O×÷³b^;ÓK57£]\7QÞ²q¢p8SÚ³¶+zuítÄ s®' Aòtí>W4K ÁMî&«¤ó¸Áú Âù öÈÈ::ßùx}î/>½±á@êÙ:iZ7[8 ²Ôíò®Ç è@2 x9¾W)ô²½j¼1c|ÆþÐóSß- +ªòzÄöï8è300s'úì Of?º]d"1²"µ´'_ Âr| ãåÖKG-V$æà&Á-×N4§¾NLTäû'ιÝ+ï¯OOVVd£ óûÎ$)¢zÅvfßr°Ä¬ßÌ3Ïç;ûà \½ñoæ<Ïc¬ääâø ÈNHù ¾æH$4ÍûÓØy`Ú£Òå Í6Ê\ÓÀ éæ>1£¦b:þL (ÑdQØë}¤QK)éÇ %ÞA×Hiîå§Ê'ÛÛ\àø4 ^zåY£DaIÁé#b «8®~ËFXzó §)@L]ÄÍÖïú±+ ÕÌ?<ãÖi7+ cÁ ÂÛÕIMîcú0 >ïô~p`ëÉI8²ý=>w$Ô-#|Ô×¾#OlX8¸lýðú{`^¨qùøónäÎ!ø8¸5"L½ üþ£(G#pÑ Q|K¸Þ, ÊðIg£X>áWÌsCÓÚÂ"ª¥ °eÈÿ O#SÁ,¢µô¤Ä9ýDõax«v~zÔÇ粯°DX÷ô Á× çaOÊÈ]ND-F¢ý4möM¤jgüÁq@µa~ã¾8Å2G\Eýýøä®õ³ÜÈ÷H) h[êfñF´x m Ø#O;ߧ£¡y+a¼ÚÊÍþ£ ¦ýg@Ç÷_îq àíoùìd£'RßN>Ð öÇf={áJ.*·×¯8°d{Ïèòâ°$Ô"« ê¦0A £f ¬¡eÞ¦ü²IR¬æ}5X 4/÷Î8{ÿÄ ' !1AQaq ¡0±ÑÁáðÿÚ ?ü_ÅIJ`~Õï Ëþ Ü4 ûùþÇáùY µü[GðXÆ° 7¿Öh°âti`@ØíÃr¹råËþKqæ#&; ûÌC§>É hiYîH ×þ9¹7{@7M µOPiüØŸý~~ P_Ë¢½pT1ÝÅ53Äùë¸q©F®Ð ûàØù øþ:ÃháT¦ Þ|þñUbg VÒz²`Ä*Îj¾(:EG0ùeüS¸³¹¼´gy#÷÷ÄÅ^¿5ÏÊÜX.¸ ³dé X¨')WGX©SYTaÌÿ § 4§².ß91"on"]ÁX£4Øá £S@ôA¨6BÚ«Qvû<Ïø¬î-pDv+Øä±Bà(- ¸ xLè` ÷ãð· `)$Ð +:¾ï¨cFÀ¬ v ì·fCñ èêê¤JÊ( ½ à@çµê¸?åËø.-bãW¸½ÃPlNY\©sÙÃÎl+Ô¢L(àÆõYF> 'OT¸#óó÷5C¯àJ- ïD¯¼hý°Di ݱT >° _ïÊe<IõËù\V"= *D°VDoxle×jÝÌ´ÁHátßY }7\ÿ ~ñÏÅÿ ~? ó/RüÄ;q /ÑÁàNi9´îAêB4Ý$¿ ¡Õc & ¥ KÏ5Sév}Ø[Ícl ?£c-ÊD ð @P½l©2 ¡×@RUÍõÔÒS¨ ;«xÀS¿ÙMëûü/ã{ÔYX/ÕÁL¢]ù& m éÙ_ùø ,§ÎSçï.\¹* ¬SÃRÙ éZ k z>Õ l ~\nà=Âõý`=0C_ï4P P R7×ÿ ¼Dsôõo,' ¹Ì¾(GE .Øw}C F*«]qm,DÝÚÔPxá Zîu!ùÅYÃT_UåJ¢QhÞµEÁ ) 6b¨¦º:dpæ~¢¾ol1 «jlÏÓ5r¿¢ûÍôªÔºz]|O>_Åf-|( d{ RÇúTKÎ " Í¡Õ**bÒÝYý?éÉ´ z ª@ ¬à×ZÃT Þà.I jº*´ ID\Ø£¥ ýa6Ô=GÀU| ÁÑÍ{Mxc,ûñS*o×x4ÙkÒÜFËÓÀJ6éZjÛUÅ#è´@l¢}þVçÆ>Ñ\³ ¡ÿ ç{2PØM÷Ì*·erÒlJ¨íÔµÝ'Ïôäàt¥¡x[EÔalÇÒ_ÈWçÁ §Î#þ³¦\PÞÿ ÍÆ# @[ [fï°P*¨o"&FKµÒÛM »ÍúÕBé! ,¬=JSd%Ò°²Á! TòFÈŧ 7°¼RAFMhÀtOéÃÖPãvN ¢ÂE du k(¶,EHâpây}ÝÀdâÇáºÄ õù` ßrâßÃó8ì~Å1©ðMÿ GÆUÌY1} `pcyÆÜØ úTïZHB6»0qm@T ªúÕwAv<ÅL>_Åf-üÄà#îR?Y,Q«´w+¸ÑSÌ jÛ×ʺ4E^P:1C3ÅKbèÚÔwûXT$`*á±,dà¬IG!Ð]: ¡¥)Þ#3ÿ 0JYEoh¼nvp ª©°·ÖSzl=²VÛ* n¦ZÈ e Nã/\©èx¡c<¯íü¬ü-ãÔÄEÏÒÂJ$!vtM ¨då:6È(H *ÖRÂV½I©ÙbÃeÔ¥ÆFô§BKWȹH;¨Þ_£5þ3ïÞ <>~úb¿/ÏÇOÞôÉ:4á 9î%Í õ>å/Áê @@ C#TE,n C»Á%Â|QPW"`O³L¨CèR)R¯U+ ÁH RzÃ9ì$V a\ªÉóì!TRÀ,}5U½"SÍÅè:vORЦB! Q½öïþòå~Ãg£ Þ ½Ä%®Þ°¨!B¦ÕFéf/G!»>¬TBl¼-~LÕ>L P ôÑX¿1DP `Y°lÉ1c@_P¬ýW)üÅ®:?×Æ ó§ëÞAMæÏ aÒé³GD°m <>ÁÑ(¦Î¤6¿ Ü% `J© 7KÑùÅåiT7M iëÏYªD3nö'jqù#F4&ºQCHµM3ÐïPºøìß¡¤ºËGUÀTpPã¶ÀÅ®V/Ë|6 ?Fßë C¬þÏóõ\0¬& G5ÑPV* P4t¢ÿ ¤Ìy@ jÒºÀÃg¬ D-=Ì 2ªÍÐvÞåzÕò( 8ÆA*Ö®°EVå @±zw ; UM6×ð#ï'ï *÷ð¼üuü(ðDpoÞ° ©aWÀä]¥VÖêbUWF 6&DID X µðÈ q¥Sýâw ï[=!F%m¸ÎX`´SÇtÈ Ý C¬4 öf»»Þ$± ýGÀÍf þ± .Ï'÷½|ÇQ%(°S°+X'n¾ñ0ûj z ðFî÷eUÒllQé=7¤ÔÈ"0ÙüksË4èuF£g£º4izÞû k]è !âøF4G EÇoÞC¼Á¼þç4aà x ôÄu``W°ôÆâ`ì,DlôI!Ö0D2ÐÚB B;V -ãÄêe9®¢V ®Q>·uÆÔipd#EbtÀF4DÞù» MÒIõ ÁéEÒUÖ×´*´ áEH衱j¢:Å)ânÇSç µ }Ô:;; =ñÏÓ7Ìn.QC6¢I6iã9À£f¨Átu1 Eä.É) ¬ÁnÅE MÒ ¦!lm³é(>Âq5®¶]uhé #¡Ht4Q08T¢Ñôh rýf@ÂlÛ±mî=? Ð}Ãjó ïàg0yX«×ðÜWFÅyà h ¾W D`pNÄm'ÌDIðUùP+LoOÔ wXC¶úf¤®»;ÒÀ÷é¬%?øCFÄ>¼TòªÈò%÷b5ås[P¦Äßµ0 ÂZjøÄÆ ?°©h n¸M`½1~[G pÑKßûÇrfÚkëX«Ô*Db(8dø Ü)zpæ÷HàV¡ÑÅl>µ+ëè´Öi¬ ?¢gcöÀfªJøRê4Mäêj nÊ á 5"h i`¸}~î~ÀÅ>ÌàäK"¡ûe¾ßÏù~?éÂk&£Ç U³,×XlôbÌRWUOÚ¾¸l y0N \hhþRþ©.uöJ°Ð¾Hd£Æ%E«PîæWQ´ ÌÞþ ÀµphE_¥&Kg. ¥%/ÉM}8Ëbaá@þÜ :Îi¨ëKxUaª¯W n"6@'¦·ÒÎâKæj¤APØMÒu¸Hl0 ;*Ãè 5N1³@Ú$6 VJÄ£l}¸À·5ÊU0 éÃ|Á ¹ùÿ ¬XÉC cÛp¹=ÙûÁ8â¿ âÖ¸¯ë¬:?x4~óï"9 y. nB!ø ê¼»1eZ (h SiÐÒ¡Ù,pw* %Sk(> æZÝøÌ ÅT¦<xtë© XEÝSjéÒ?V@¼dÏúY£göfkíà ÒÄx)N%xÓYaq´º tèÞ«¦ÉÔR-éÑy±çÂX4w 5Ó ÞÍD 85³dù@X [ ÐY,í w ÐG¸½( ®fÜc§äɾÿ rꨱáuþqATcµ5g7¤èC 8 ¡ø»ª¥(Àì&ÜôX?L~&"ÞáH wï?Ha©ðÀ÷F OÌó. {t3×û|¸îÝ zíÿ 8¹z6èïM?Øxh¢æ #ѤS£µ@¼¨©U«¾¯qÈtì¼`%lpjÜ)Îãè¬4Ú?F0rGÀ;6GãNæ<=tÄ Iª:R ¨9TºÇ(@üA×¾cm§jJwEÐöÍ1þ2ÔVú_^M ¨Cè8_ϼPA<8³"T°HÆçJ ±@Ö§ÀRäbñ0o3ìÎ/« WÃõê7w" t*)\ ²/ø¨x~îPõâ68G>§x0|«óX_gã FÖ7Òa0¡AeÆcmËí_¬Úíà n @íØp¨-avZb¶Õ±!AØ?X=ON½Jàî0"Á ;NÄÓÏ.¹í4iÁ]:iAà oïæb¼R!zPCªKø?DTv+°jxéÜ£ {ó_£»ëCûÂoNî$³ ï{mÀ¹5ѼK¶+v)TúZë ×FD]\Nù·Â0¥ ¯Ð:¦-EÃF:É$òL Oyõ<Ågã>£6ÖT VíHË{?ó&óÜÐ:MAÒ¬3±Ü /kZÔȳNKfÌÙtßÞ<õ#é¨p¡¸ª~Quyÿ Xkõ×®ñ !N¶: ´¨+ aZÒkt˳p/zPÞÒRXÜ@{úUø2ëêêäõ=G½U¢Pów7§ÔF]¾HýÓ¶{Zÿ °«?x JÂ2°Ò+ ¦ ;i`1«¯YC¥¶ 1ó ;-C±4i! 4Bª´ UP]Ï19áþ`9g{Oð]Sö]åð¯eâ¶DÆÇPÔÝÉa¤0À¤dyjS» ôdÑÕn¡ K¯a мH&%© *ÿ ÚæúΠدgï:X«ë(FáþðwIZ¶ J¦À°ÀÄ|#©z ~±©¯1.4Û rbHgÔ#c¥ÄYA`i.#À£5.áï(;«>¶ qɧúDÔo)Âà§à@d ìg , ÒOÊAÎíÎPIÏð`|=A÷o ý`5v\}ݼ!_ Rn*h R@\é@ãZè/§n81( )â6ù%»¨-ø=>_:Ñ"ÅÙF¦© °mÆÆ9ÀT u¶X~¨N« SÛ¶6ËæR«RSX, 6 úU^)0[𵩽b,àµÃÂÍè N8s®Úèµãà(¼¡\AîÁÞM|Ü 04çÃ4ÏóÁ_5³ó·$i4¾d¸:64j&´` &¢åL ôÑLnèðÄæÙ:8DêzÆDBa¯wG0R©Ü#¹PjT¥UØÜDÌ TÙ®kì ¬îT/W p)Jªáah"ÅZóçë¬%ê×»oËmq4P!%© DÀC@ ÂFuvë`ß»åøÞ.Ì©ZD *×ý}ê¶2½Â<<eKUZ ôDøлÅÉóù*"ggxÝ)Ú èH½©NØó} » `©]5¥¬å¦=³,º¨. nÖëX% èpÇØ"àÃ:1ÚºDØâ²M/V¿³á´Ãm¸giäÏCû0ñÏ«5 c_¤iõíozßÀ 8b¯z0Ó³$%lc=éÍà¤]0¶1Èï®$²Ò/ ]mØ {? A-Ú)W«UUP4Ô=ä@P¢[H, û¹å£DaB!)Ûk)OÒVR»<bãô¡Öe¼´|¶à®n¨BƲ¯7¹<ää `&écܲ,Q£ºÈ{(Ô A]qà øENjµÕQÖȧ©WÅ^ ÖÛÐ £¦FpÜØMHÍl×g¼ÉBoÈvo@]Ϊh nîÅÍ¡A0 ÞÖ¢"SûÈá >¶õ5MBWrN¸@oT±Ý 'ô¢nÏSîòx?-ðW¸áQ¥,ý «à9¬Gö|àFbÛÞ`ÊYL¦ípP|8×ñ.Ë$( Ö*wöþó ëë}¼Á?·É .cª¬bSáÓèBÞìè ÂhkÓX6]JG k{Ôn3ZW/æ%I' Nã t ÀñÊ»°ú1D*Æ*Ð 6¡0&ÉÏÈÿ x )"µ²ßè0ü:øÆ~éƤW¨ÎY±FwÖ iôØ×âFUñyTy´ ]\h"'Îé7) ,¡ZBmäq\y kÔ?VdÖWUk@çÜ â¨$*Di[+ ( }1Ò%UÖð°"8è$U!V3ÆûT°]h+@'A:LãK×@©£UÁ!VhFDU²¬"©(í 4SEÁlÁ.ÛG^ ((:wÑÆ>çÐdBóþ²J'¯FHõmÚ5 f@» KÙ¢ 1¢I Uv«î4aè)ðdï\@ ^`T=ÔU1ÍÁ}¾4Ha ä±¹ k#§¡ ! ¤i Ö@pè,ÜU°"@ Ûè3P tÑpMÌ£Æ`g C,ob,éD×t)j¯ Áhðiùuc0S¢-mB;·£4ÍA¨XÊCø x ¨Q`¤Æùvº{þñý) ]_°%öß"_aGÇáh¨B1GäO» ñË?ÿÙ |
| URL | http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160 |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 343 bytes. |
GET http://testphp.vulnweb.com/showimage.php?file=./pictures/7.jpg&size=160 HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/listproducts.php?cat=1 |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 394 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: image/jpeg X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 19219 |
| Response Body - size: 19,219 bytes. |
ÿØÿà JFIF ÿÛ C
% # , #&')*) -0-(0%()(ÿÛ C (((((((((((((((((((((((((((((((((((((((((((((((((((ÿ È@" ÿÄ ÿÄ ÿÚ ¾¡ñ¢j4ëÝ1«j(: "N HN ZZ2íVöû·£Æ£*$ ,A£e¯Ë$«s4°óÛJno¥ËiªH*è wÇ7¼ÏÅÜÆXî}Î7©Û Å5[9ÕkyÝÍnæDèÓL¨ÚH2²r>¿>¥íݼÍv $V®á¨:¢ `NËGRªoDíS¤=}×DâÖÈ0r"HR·^ºâjå±c½ÔÆa`ï$Øm K5ÍísyÞ¿¾½ü;$ ¬´§Ø9Æ2Õ©gpâ v ×6v·?¯¹Í}ì{¹ïªúP0U§^,ÜõÞ\÷ß+qÆäXºãµÛ ÐCs#AÊ~¸ANÄfNååô¢±ÇÝ˪µ¯WÈÎ]¡Bék/*U'c«r*ëË/AQköiçÓWÒ,+jV½G|uq²¢v`g÷äÏça\Ê¿èTw¼¢$U²Ñ`ïTÀÎoHçÓz WÃfÛ·J7þcMغri H"¶tcãå Ñ×Hj]=òó7qi¥«Òù_EæÓö5 e6?©cmpXP·wÑ,ôq£Ï è_Z·sù¼ ´xÒE¥2wÛ9º úôtdëzÎÅ4«öD' lèÐål´PK1æ¨ ]l³Üù¦zÎe"äì<߯½ü¯cFÛ :VÖøg×>[ú4 nã´ÍWô:8Üí,të·UÑÏy×X¶ÉÊÄzF³¯kIÑ£yfS¹6ÊJN¥[F§oO/I1«Võji¹è\GmçØZÌØâ ÒÄR{Ï ¶ØB*¤S3B ºÎjÿ qB÷Ë®êfj2OnXe 4í$ÕÖ |ic¶8åoF¤Í ±WX` ȼô±*9jÖ¡íy/\þÓêà Þm£wô*º%κjuoæ}Íîc§@ãImq o'C9À6g[nÚ¾dc{TÅЪ¹µ]Lm9qõÞbÙ[ ^vÛhXÏi X;Úi.` -R¹G ÷¹GÁRsû¯?ìÂÛZ&UË´8ÍÌcñ¯-HÞ-Ò V×;Wcç[rÜ_¡pûÒK0_z¢ÔÕ¦-}+¾ùJƶq4 ;?B¨¦¬ØÓ.µ$\P£®±£BSÂl2VÀ½Ìk©cë>QèjÉ[ïçÇïF¶µåÌîXªmbôÖ3ï3Ôù8jÇÏEÖ'T´ô ÖiÈ`7 BÆ6µ>Mò°â°> é^kËè6ѳᤫYÚý Ïï0à궻Q-C¡nH_Ç]÷Ï=)mÈí®bÛ h<ÙÒÇhVÍLÐøt ü Ü U }´l@¶qÔ §t?¹Ð'r|X1´è ]|² p3ºð ú{ D2¿=ÄyåÊÂÿÄ * !0 "1#$2@CPÿÚ ü.ê¿ùëãÃw~@[PZ7vï÷áÜmZ[ZYYWÛq>7bi_ATßÕs-Ê%ZüçÝÑUnØünÑC«°,oãsZ·U¯ºå¥ }¤UQ¬ù-shD~ï¨ÛC /ãs´ßãq¢4=t¬RaJû®ãíƯ údÙ½~güu@6¯"®{:¹¿Ç$ÿ Oíc`¯½ð²µåãtQÑææᶪæý.ÈëØ9æÛ Ö ²» Âêf×î.¥OsPT [F#Î÷ôäÔ$/ãÆ ÎõPÝÖü _²Ù¸Më(·.á G TÀ: ÎOåÉ~´AÔöë«hP°Jº-Õ72/¾F2 CôÜeV;ù,¶±Jc÷÷»¾ÎQZ_µVS¹ §¦Æóò¸êGF´ò¨ ØWÊ/®êXÂHÝt]hrrâÈËãÉw²<2)½áÜahxFU 1ü¥Õ×æƱìÅ̼Kð3Bq?õû.\hQQmu.7?òl/nBkunÀNÀ´ ggXÿ Fÿ ;5 ¨×]óÀC;¥\kèÝ o¯Ñrý. eÕ³ ئâYò<gºg( þÞêw(V'$h÷pÓ V AòV÷.á\it;ÊdÒò Zê6ZÐCâ¿+ô¿K ãvÆÆã8ñßÇg·± Å`¨Qþ&ê:¼Æÿ TÊ3¤z¸ª f ûF^ÄÜÛ6³öã1®åÄE`Æ2ÛK^/Ä_Múñ¿! lèüWUañ˸¼ÜF}Q-ðÙFóu ðð°lßΪæý·Z*1eåâ4?# ÇM³jÌc(_mjî ¯ªåÆÆ©£Z¹¨¯*òhbïÆÂþàd+b´Ø]vw·³¿KUq OÝËdØñy&ì|± òd*Öò[ò¼M!(*ôÜÜÜíøoÒåË.£tkÜë |vãq18am£!ÌGÅ¢ô¸pÆ£>'kbr ª»TPÐÕzoÔ®-¶· ÕÍþ7.(P¥Ïç@Ì6qêN&Md=|rµÙ®2ñ¦ÎËspÙ«ï¸Ã¦8o?nm=?&²)£v+ð"Õ @õ_î¼[¯MÍú_¥Â.Ë: rÊú¬\QYr¥íä¢ø¢s+ælàâ9ÜÐÀ§ r~é ÀÇY1abÆöÆ¢øÂeÓòyËJ¹¹¹¹¹¹¸W< cßp®Y N¹Ç!êÄ`²®©¦Ó,ÙþtÚ³´í 0j/0ñYÁ5Íkk<Í,H_°Ô^ù^]£æ ʹ¹¸ÒýDî¯sp¦=wuyÉMð3i7#É´.AÝ»8 ¬ LMÙ@²»6PÎc òo§y¼¦-Vp V±ø\9úÓ}([[¶ÐÐëq¿Æ³³¼ÕCÛrî ôݧ;!FlA6 ÂË#|¥B4æ_ëkäÐ}³±}ªðnwý·Á õÁÌGc4ãk1]£È¿íJr¯Öî\`ÑKXy±-m- ]Ê?¬[-×iw *«Ê^Awø¾'(ʲ²O®&u ÷"Ì 33 XüxO(T3ÿ BúYpøñräZ²d*æçiGóëráÁÉjesøìp2få~æfä3 ¯ä1ëôSwrîXyÅâ0 4µß·N?ºgüÎe?'²V.e¹jÑ @¢áÇCí°²!¸»ÝÕÍÍPãõESsrå¸"Ò. Ìò¥,ËÊw{s\7ujȧës:ïÒæN1ë Nªÿ ^i933*Ünwxw¾8üP~fy§?Îì%Ë]îGÄ¥ãb`[ró«P âPÖå|ÜÜÜ»DÂòn°ñ]ËɬXÕùPî2ÆÆøR¿6^H¬2ÈÝÁ+âX.ãEy9*,á¬Ó t ä±Øöåcx©UUOÿÄ + !1" A02QBqÁñÿÚ ?¹s(_ú/érþ£³S.ÆŨÈWÏìȵbo`LUóö=0dsÄz /Ý}=̺Çù ú_}ÏJT6È;s6Goûñ 'å=/ÚºO3{Vù åJ1ôft;|JSô»üN?_MÊûuæfÕÉÈüaBÀ.W£ö éì0lg¨`£paf4&¾oMåÆ YjÀÆC 3g ãø¨»,fnjõ55\?!3räyùûQ¨ÄßR¼2¦ Ц¸Å\ ìy¤#!iXãj3]®CÄ°E´¬|ýî¨~Bæ®×º8¼ÛÈØW¡Bç©cß`cb¦ÄÔfg¸Ç¸ÚÀÜÇQÉ2?D[3>¯²@úÇ/3K^¸ÍÜMdÀÚj[ó3æ|¿Ìý¢ká9MLÇüüCµuQ2|. &` ¹Â±z°^âøW§ BìC7°Ù¶n¦E£*T©PD5?U »ðãÅb½õ1õæPêRsiÆ&6æº7ÇBl¹3??òTÇ ÄÚÔãd2¥A,@f*±%õ?°fÆ·% ±QqàÂb \Db îläöÇBfØg^&*zv?ºÜcá8Í«=P2ÌXY!@@¨O7s5þ#kün¦,Có0 ©þf|àÆÕËí5Á®¹ûeÔ( ÌjQ® q±ó YÙz Jó¹K±k Ö¡"ª{?Çêd¶±uæl\¥EYt'¶ äg³Os ª¯S:ÛOjùx¬$(îsùBHz Ï Ìñö Ì£õ*fcU ¹SUC5©ù©ü4 âÿ ßýL±¾æ^§ÿÄ 1 !1 "Að2¡0Qq#a±ÁÑñÿÚ ?ìÝæÛú5Ø C@Aý+q¤µ®@Çô5ûUrûGÊñà=8h|ãÃñÀmsÁT<£ÆÙñ.óf[éüÍ3«/qànD¤(müs;ñÆ=f{uµ±Ç¤KÓ¸g ±;å(ÐÞl Ä.-³jäNðct̷̸馸!éé4öóà¾é¶iun5¼ÔÞ0bc _ £!ûÊÎ ¿G¼}F7Í Ê·#óµ @ UÂÅÜ%õ°ÎÃÍmÚç¥(Ájèf«HïN14-Ä^íÉ E°7O F Ô q^ó*%ÎÜmÆfË u¬r{IUÂÑm¾OI®pWvéðÇDMÂ%é«;z]I_Ò<VÙ°f[xuþäÄÑ`Üæ_¥ÍÀt·VÅenúbWøÌ:öªcPËËþa·Wõ,6¾;¦÷ïíIfÓ´ñ47¾Uæ)ñ4õ©È Û5` Íc ð2eM½¿oÏù1Ú¿y\t:*õ ·f¥¬bW·ÒÆp%îPzx 1¸1>S5:]°ncm ùûM6¯k8ù ËQ·nS5fÕnôµ±+ÔMfß1o´® Fܽ÷Åg¤MÌ&%ÆåÁyU¥Öþ²C+²Øf¯vyäF^ïnà >GÝnäÅÔùöæZçÒk/ry@p¿Lªµê º»ÕÛ,Ô>7%zì@ôæ1ò¸¬ý °ejç$MF¼o/úDn _còG÷ ½}ÿ 0é =ÿ Ü èûg ÿ ò.¸ )Nõ÷ïß¿Þ ©jÒ¾²«7®faFx55-ÜpfµígÆfá99ò\¬²á§¨ å ÄªÔ Ùûû1é&¬ ° S0PþÓûO¬ØÜEþ ¢ôGïlbÞ2-ëÍ[¨²úMe¬µfiýæb²Á¹ÿ ãóQ5CÈL¼#øÿ sHæÛ¶·¨;6ÉIÝÖÿÄ : !1"AQa 02q#¡ðBR±Á@rÑáñ3b$4PÿÚ ?îgÿ ëü± Ü9ÿ !¾`°¶ð¼A(t[6úåfûNÞº8+"<rKAVQp§/3¤«ñüüǧ0Fº *#yÖó?]#ùvÂcí÷,2éåÅXǶ9µ ÓÀ![x/Üx2Dg ï|½¦ `ê¯=FOª§hUg=µS duãôQøxx&ÝU{ Îë]¡û?^¾åôÂ%¢×îN3 ¢ÀZzøäΤ ã2:î;:ürF>¿ºc ölîØ7LdXÛgbV§ ðë83ßph¹ÜÚÿ vâòÞþ¢ËK}c/ºé3û.ùT·NãG3 æÜÙ pÙ{*ù5À~?E³°RÉÝ º¸yf5âëÞwâ¿Ðj*ÝwËLÂP' 'i>ëd'Z÷JmRØâ¡ûÌkþÔ¢Ê ÜùÂ=0¸÷2ù~±0Þ^1Ð Àò÷7SË Ï!PÕÌóçöMÉ -Õ 3ØÖ Êb0·|<£h ÃT6Ö7-áõXǯU6´W¼µÀÛ¿lÊ5(Ú]ºiçÉV©RÁ³Þß;¾ÛC¦8ýxê±ks¯ß>×κ´ýýá L@^NJ Û2°÷þ¢sA9#4hìäg<|âV9Ôj7%墻¢##$¨q®ÍÃ0wÇ1âÁì<6Ó{[Ã@ìôûÕÕ¦+RÌSkU?á©»!ÆO *±m;«ÜÐ1)®$Hok ôU¦¥B&÷ÕS}£8'6« 8Z±§àZ'S\Àn÷ ãÕMÒw´}B.×â¶ÞÐò×4\Ú|_ÑS¡¾fòÉáÏD1 9(v$i"Usí/$Í2*bÚntV:ãXê=U9\.2{ }íaë¢eJmptúª´j=Ì:OÁ$uð¹ .·þÅ2HFpGtì:O)RÙ3'_Íxth }P}7Ò ßºg]U:t8cDj±íHTÍP÷Õk-§¿Úz({EìqÆ?Òx£L[¤Ýõì.c ZÀw$è¢{KmTÁ¬ËðD3¦h{vÏr¨ó+ÏJw`àã¶LrñìoÏ¢-ö}÷?ÌíAôÞæÙ?t¸\5ZÇ#!°»{¤KOÍRo¼==ëU.Æîºÿ nÊ Ú%²3ǹ¼D&ºñ$ #°D6ìº[y~«hÀE¹ÔÚÖâ]® ¶Q°ó \ê¾ÚP 5 ¿U _{væSJ`T8x8Þ 0·xàölhCoÖ5+kE̵°ÙcÕIt¥=¯uØ»° îH²Î¡æ9OÍnd N»tsÓ¹ö $ Â-ÿõSB¥7ùµÿ Aî¼3£Q÷ú*Û>ß3%§yløLªsKörw±õ ïö'7Ú+]Ã:'Ôtß? Æ©»çt!q.}¬{XíÒåúöØ èRÛ÷Q Ó àâây¼ҵÜÓÉ´¸âÓÝʪ:ÍM:ü¿T0좶³ýéòܶÅÎyÑÃ%¥ìÏ e>£% ÉcôTöu)Ó:<ê9 qRÂtà2·Ìäa $Ï´NpÚ:ñÇDú;XQ1(¹Õ=ÿ D Õ6«ÉÃV¿õM§\[v¼¥lö6È ¨Ã`.}¡ó -|QuÑÿ ]T¼ÿ ãÏü£"ô÷LDáÐu_ûFÆ*@wÅH$pRpÞóîüb8fZòbõ ÝÞØçÃã趮¨ëGáhm¹ß ÇdHïºDÂuzÛ´F ¿OÆ © 5²mä¬è ÞýUùêîvàÊpi qåàxjÖ`nkhÖ Âp8½®ÍÛ[wµ ÒÚXAÌˬÀHÎRe[êió⦤ÖCÌü¹)3¦æ±.Ü> TmSå6·ÓónæÏhi0u mZ.¹üGÜ¢$:(g¬ÆfZ2YS}Íäc+òõäe¯.Çt÷FØ.ø&3ÈGrÅï4fìôN/¹×béÑ ó*lªóc ôMö¡å©Ãy ðï [fª c 2³éÊkè{¦w6˧öãÁlÜÇ 24Ò3$ykLÁÈÆ«dlk@Ъ+X qSl¦ÊµÌlãEL ÎØ5 Nó©º A¬Qu ®ØZ^Áu§"e²-'ª}IÂæ»GZuùGZì6 µÏåþ4PüªÕIí:|B©Q²iÌóTö hB$º_ùÿ ÍS÷Îóʤʣx¶A-á÷)ΧçäÚh$ñM± z'C`©NkHoÁ7½SX*4æ9&lMÃ%Î 8D Öá1æÜ7xö[¨ÔOÏtÐûaÏn0kxÚàÞ ¾ÑRô5ë¢÷ta Ù3× àt¸j²ÌCZmpý¾©îÖÓç|4BTÆ?ç¨_ÄÕ4 Á¹!ËX ÏsÞÒsú¹ÙÌ«º \Zà?äåþ>H8¹» @Ô¢Ò 7 "ÓæiÝ(2Ð<õV¼gΫF¨Þ ªQ£AÆóù ºèíKG4Ê©¾5# 4Ï~ÆÄcªÙ¸ËGôqïÓÜCë£ÚÚpdÀþ^¥O+i7#Áj2y Û^ÀDÜ[Ð}¬DGßúVµ oq=;0'µ¬Ù1%KÚßépÊ-"3¢ àúx¿/dá>ÖÓ/Éûê³- ÍçSþ&ç541 ¦myð4BCf7ã#æª2Ïví øpûÑC[å7 þ\Â$ "ÚNàS:ÑÖ; gµÅ¢mê:YJ«qaÕÇpÜÞ}ÿ sIÏ?ÑwÞ¨ ¯u @ Ñ@T.uÎR«)0F9rìWNû=óð-'Oì®ã~]Ýß $F§öçØö¼eÞSÈÊkZt<Ó`Eã «:ýåSÖé$e]§ªb,ëQÛ±Ë=4T¨û5+0^x©eGT`?1Ñ n$Ô3÷Õ=u73_kç L yõp2£ØÁ¹ÎѪêθöÆo¼Á/CÍoeLgºXþHøËèþ ÝTÅw<qj© ËÓ2^N¿sC't¢ D4È í²Ýâ¥ÇúöKL±}&þ1?Ùp¸+]]òÂ,tÂk;1¬è7äpÞ?D ÏÿÄ ) ! 1AQaq¡ð ±ÁÑá0ñ@ÿÚ ?!ýJWÿ À±ú§þ+ú !$IãªßÍý?÷g% ýÌbBIB#vÊà¨p×ûì`þ¹ôUÇôØÅ´»ßý~ø:¶Â2w®WÇáÿ WÐÒcÙ ¤9 ޣˬ¤,F¿ÝoX§'ôO¨2Àääú¬þ Tâ 2-'ÈK&sÌÍÎBÿ g\Xp`s& !£nökyk~⥲O |¦ qX?®KRMÈç4C;ú¾¦NõqcôO"\cdöb ]®R×Î@¨!îsÇÓ56ÁQ_õq P]a+Bt<½ uÖ|[Ô/Î@ÎÊ:×ô}1V999>Ä+;`&j|*+8÷äf$¿P+¸ö¶÷Æ2ÏCÝÏOa2HÓÐÑË>äXĽl,3³ Q rÈ£ !dÚÙíh | $ÉÉÇYh`¿ißO>Äj21CDÚ-PMÆ,=ÑɨÚKúDÿ <û¿C"s$ P6{íO,ù>H£x|=}7Éá!ÜuW8tô8P¶_W}d¾ ïðÎD?eO¹ûb$«åX{'N.iÒðà09 EÚþíÁ¡ÃxÁ¦a@ 5¿ãM&*|üa ,nQ # `%ýqI,ë':L[xÊÈ}zràãwÅÜmý°Ð)Xú 8¡ûå*]{Yñ.ÁÆ Ý-Á9'7 ¡H×M óÿ ¸Dv~!¥àýðp+o'] q;5VÑcH¢'l ã~Bº$r¶å ¡Ç ã# 1°Ô ªÒu>s&(ZMILVÂ¥S×¾kEÚ·Ùã#gv¸zO¤ú¸ë)Ò2K4§ w'¹. ~Gì0½§No¢ÌØé0¾Q8I êê(ær½Ü4hI ¾øÁF@+q#öɾ[mÉóíQ4CQ ,8£8³¹)5ÈöiÂàÔËÖôÍy òQ'h19 Ê ¼@ßõ #-{!Ç_à?¡Ç ç ÜK]vÜUQ×ð C)Ûmßq8VRoçóíz+(ÜöÄNËÃZ²¾?פÄ7Ä#< 0±DºÏe§ô¼*·µp¯El<u;Âölà"7ô®å8$ ÷ ÁqËÙq°\vÇÍOÂG"}Y»áÙñK§ÓËs¨q¹¼·ÞDÅ Éôÿ %2YRý?K(PNrС|ÁÆ[¹ÑkunSTh¡÷DsI@ WFvdõI¦ ¶Þ3áë'''''Õôwð`Ál³-HÄbA)¾rgCNËu¨ ºxxë ³`ó¼¤ lFýÄøÖNÞCðNKVf¥Ñmd .gÇ/ û´×ÆB@± ü¼Ïé''Òcøe}îÚ²üå\ó1ÛQrÿ u?é¯%(KÖ F(JÜK^ ÂÐ øic¬× 9Mà^¦"xb!4 $øó£ÚÆfÓJuægÄ`)«ÝfòÑ]ù2·¾ø U¬¹Q$ûßÑÀÔtBsq"K¸-måç$QßOéÆfÀ7/ ùߤúM Á8(]ú*pf Û5çÏïã 2I9(?5#2¡'Ó³ÛPáÙäåyÁ$ÞJ©IHE¶Y5ö?r¦ûÑ E`ëÒrrKOM1G¦ PíI\çãqñ-Ln,ª¯¬îì(Ýç§ör&JV.gý÷[\vÍl§Å¯8Bª ηõÃ]µ¹0&FpG¿ìÇ!ËÛ©K ÈÄès»GíÖNNN&ªðÂaJ¸¹ºñÉ]áöÁ@} d2;©¸é 8Ù EíßX(DÜW:M?t_÷ ]í]OJ{ p©7cE]Ö¾3iúWÕc¬qÄZ¸cÄÏà\ ×> }ñMߥî?°}²@¤9,üý² FZ4Ûܾ+¬Ù¦®0X½503@ò·?ù6´òR¶>ºûä9¡TÓÜÎdItfBã(BÏ¿{rsиQ 0 ݧ¸ß¨©\@@`8¥rs|s ñppÚm× ¸ Z ù«'x»ÔÓ|óªY<ýqAä<è>´s #VÓÒ>xÈEPñ0HXgGµbÖ/YÉõ_EéH Nq&3¯$°ñÍ)âzñxÂ"äBç&<I{òà0r)ääË@f .¶þìÏüdKS$]ßËÇH''Çäb²¯g½Ä÷Äk¡g @rex KØòÀºu0ªäÿ 6ºÚ[ ÍorëßÙÊS7Ö%ß».O¾þù4öâá©üÖ Hi,B`¼Z?yâãxóbÔqnCÓÓHÁÆAíòLè 1sü¸F D Ð01Gbqãüǧ5£ãó47%àÉ¥ ij1&þ"2¢¦59nqqå¥áta&&¯ qU%A½i¨-úd Ë?À_Ê(¬4Cqro;Øã®ÃÆ2fú`q°ô)èø2±D,d²}ôß5Í3O@Þk&Ø%x3]6G<·SoSÎ2×°^ÑκÅ8 8ì§ØRs÷ÔoyDkÏ?lè¿ /£zrtx<2æªÏßøÄ2!Ð èøû̹va§Ùóç$ r":EÅ}'â²"5¹(3¨2 Ü{Í`Kcx f3ë6G8Ço ¼á©^£R(|VMFDÙ»Ö^¢Î(÷ô~.+ÍÍ&9Ý Úª·ë \{~?muIÁÁÎûÇÇë¹ëµñßv ¢_Û>¾ç9_¢nQ{8@,¢ªwßOÆAX«qQól ÕM?\nÌ_:æzþt -W÷.KvK}Á'«!ímAæp ËQäùq 4&ÏÎ?I}*ÆP7XO¿ ¼R \hõ0Çã 0ȼ` @±1¶ãë^S¼8ñcÍý{©h=8(P §ÃÉP8<°ÁÖÀ7¸ãëXÐ0lK ` Üÿ 9Kɨ`Ä,*¢KX7 {8âtÂN½A4íPú reÂN\ůd^7±H ¿Ó **3øáHS_äè$S I=²II·õºàÆK Ù1°äë RÚ=ÉMü1Õ JÎÿ =bôȵÞmf ~çr|9~q*É ÓB&L)ÔൠMÕdú$ìõ߶ ¤Òûc& ÈKs~\VttÅÄñÖóð$ ¯Ä]b»øT=ò)µÁ;Ö6O$q Áã_CtL}øÍ9 OÔ ¯-¾,*Ö FØ®Û}òh$@ûë)SYÇÖ~¹4OH}Èt@z\80à&)ÇN8¼¾uî´Í Laõ$#íÎL299Ç-bJ\UÛMª¶V¤wÞñ´ÉUéJlRG '8?{U|>Ùp³ùÀ¼ÃgØÄdJPcoûÖR"÷¹Åæûgqªq|´\>0U'aÆÞ9-Û'ôÄD æÛðòã@Ðv7 ²Màݶoóò¯àOx2 Ã+ý§ù^|b½µÖ~?ßlµgØpÑ|ÖJhÙ&È÷?ÑÂ0 yf¸ë$÷ÎÏ^×5ç DWÆ!Ï p5íò©ÉE=ß)³ÚxÁÐåX ¦$ÄæzÈá[r½U»ÍôS Ûõd&mO³æ~5s$µÙ.ñåvQ,xbj!åöÛ¤äfzUÙ¹4÷);ç;kÈÂa*|¾Às 5ÒPÑÖ%¡$Ø×F·IÆwFh|t{¹ Ç{·ôÄdOÂ|aSQu_¹:Ö!Õîo ¯ îç÷ OHÌrË`õêç7ÈTr 1¢! lxn@z {{9ÎJcËl/jGñ6v³ Шykç7(íÉàR'-ðª;l~%Ï 2ädY/8³¸4`=ðÃÀóu ¬\ì:ºâðiËÜu¾p+i;ñXÌü"! ½±â/´æw! ùÎ,¨bâ>l,Fìd»EW¹§nÖ'QóçÇ/$X\§ Pò÷õËÒ /× ÄT,¾Ï4ôm6Þ(äÀÒdiUîc) ÿ !rX§cô§v(<ÔG©Qu0]G¼± åF)YüXÐhD v×͹ï××êJþó`«'Ù;KÖH¥(uÛíJÐ]Sq{:sÎ ¬cH_ÒqQ#¬ò#ÉøelêÝüápRØB.§,»ìêâïa>Iþre6®sÛƽ³3U¹ùÞ*M¾ ~ÙÜâ"<¨wç! )ÄSÇõXlè*+ãX Ä@©.8z×0¨µE½ 2ÿ F©é·Iîc)+l éQ¼3 {VgãsîÆ¡+*J¸<<Er Eµ~ÿ ;& JeÅóá¬,"u&§ÌÎHË×(Rý¿b³Ê´9ãZ¯0Kf@ # û;ë/õÔ `¿ÅÓ¹ïÑ/]3ÝÀ ûþX'äaø~qeòpj¡9¤£Ç¶"á¥. oQ>ÛÀAJÍ8XÆpø'yH§'3ÿÚ É ë=¯ú?wÿ ÿ ÍÅûïÿ ÿ 2ÿ Ïþèýïã Óp¢rÀ£Ö<Òþr+ªÙÓ£ø$Á$¾½ðAíkQb Ìü:Ù*+×ßÚ®ðZt»º¤Z'9þÀ¨³UmwâQÄ4L¢Oúyp5ͲsKó_Yßo<»WÞ| :BF\þ,}+Hg=ÎZ¢öl5?ÜtP¿¥{ÍBìSɯh â8þýп~(öò/ÜÿÄ ' !1AQaqð¡±ÁÑñ áÿÚ ?i 4@ùé^ÒY)âZ¼NgÓ¯Hî.\¿ ¶²¬{ÌɾÓÎø_nê>8\(U pÛL{ÜIR D+AÒaà-ÀK©Êááztáëùã ýó.\¿7G `7 \¦:ñ;é7prÛ|(j\¸7¢¯sZ l@öé}eȱ Ûyúë ª uë-DTÍÉà` èo^oÊ [W= %IÌ-oͬ{Án4¨S \j¨k¿hÀY5u̸ÆC¬¼¯^¼¯hu m߯Ä((ë³ïrÆ·ëþÝÜ+çëç[qõãÏð8éZc<¹Lߨäã[p©¿]¾ù,Ç&Ý÷ôÍÒ_xQ^Þ*ç¯ßÆÒ2ÀW³ß9^àpBRL¸_6 kÁËßÖt#¾øGXk-o}+5þ&<J"\n(¬G¦¢ôå¤GÞ;ö÷Ô.¼âDA($:¡.F4±¥è9ï×¼Ê6V» `õçÄ!:Ýs¯ºøbÔ©VAMíûçå(׻㱮x_~¹&¼_®ñ±¬Ñ6sÐë¹o È@Þ36I%âæ eÑ¿ÜÊ¡W^_ õêô8ÿ Ía"&¯®1tïµKp1 Wä9ðdEF dö¾÷é;ø ¤u2LZbIn®:c]¯Ki¼' Ê{@ÜmZé¯íCß{ôGEÀ翬Ï/£wëÞ+Õù·àSä¥`ÎûÌÚk {ü3ÞÑ@µòîúKEÄªÚ ,]IÊéÿ aª_}±*ÞÁÒ-²¢ Ëpâa+1iM [ñ¦<ê"Ãô|:úó&¡å¯}ó²Cê 'ïRÈù?+»«¾ÿ ]2yµ¡Ý@ÄÛ·¿}eÙ ÎÒþ Ö 5 1en ÁP jÅ d ïïÝy2´+ó©§ µÑ¤¤ E[LüG\Öd¸ùFýe.ÖÊA¥¯F À¿Ù kóö عâ%|ÌÖÆ,CÌçÁÿ ¾ÿ ²¥\Ö ³ÿÄ ( ! 1AQaq¡ ±ÁÑðáñ0ÿÚ ?m ûÿ D8©áßÜç C¥|A ¦cßlè ïßEtÈúQàëW±ºóç¾æ ÈÚ½j®ýÞµàÑ;c£ >y8¾¢ 80µ1ü½5dÈ,L 1H2ä#E;п ð¬ï÷õÁÉÉÀÁ1Vf8Y%:i]GLz£úî[ÀÁ*ïÝbtâ7®ø$Å â .<Õf ã®øîN! y¼út®ød¨öøÿ 0[«s°(rX7 K=«& 3EM{äx$âá]úuiã"I®30tt9Ú~2¿ßIpfÉ<öô#¡=qYfnµ¨Ô]»««¹H¸µô/qXÐ=& ¾zõÙæ°Gy<GÇK¼à§PÉ W¤Ø»? ¼Õ Vfôòó ãË Æ7Å»¿JÂéÆÑÌ}&q£ 1ÇNÕ«D`ªÔ§XêÕå MÈby§¤ÎAk'O×÷³b^;ÓK57£]\7QÞ²q¢p8SÚ³¶+zuítÄ s®' Aòtí>W4K ÁMî&«¤ó¸Áú Âù öÈÈ::ßùx}î/>½±á@êÙ:iZ7[8 ²Ôíò®Ç è@2 x9¾W)ô²½j¼1c|ÆþÐóSß- +ªòzÄöï8è300s'úì Of?º]d"1²"µ´'_ Âr| ãåÖKG-V$æà&Á-×N4§¾NLTäû'ιÝ+ï¯OOVVd£ óûÎ$)¢zÅvfßr°Ä¬ßÌ3Ïç;ûà \½ñoæ<Ïc¬ääâø ÈNHù ¾æH$4ÍûÓØy`Ú£Òå Í6Ê\ÓÀ éæ>1£¦b:þL (ÑdQØë}¤QK)éÇ %ÞA×Hiîå§Ê'ÛÛ\àø4 ^zåY£DaIÁé#b «8®~ËFXzó §)@L]ÄÍÖïú±+ ÕÌ?<ãÖi7+ cÁ ÂÛÕIMîcú0 >ïô~p`ëÉI8²ý=>w$Ô-#|Ô×¾#OlX8¸lýðú{`^¨qùøónäÎ!ø8¸5"L½ üþ£(G#pÑ Q|K¸Þ, ÊðIg£X>áWÌsCÓÚÂ"ª¥ °eÈÿ O#SÁ,¢µô¤Ä9ýDõax«v~zÔÇ粯°DX÷ô Á× çaOÊÈ]ND-F¢ý4möM¤jgüÁq@µa~ã¾8Å2G\Eýýøä®õ³ÜÈ÷H) h[êfñF´x m Ø#O;ߧ£¡y+a¼ÚÊÍþ£ ¦ýg@Ç÷_îq àíoùìd£'RßN>Ð öÇf={áJ.*·×¯8°d{Ïèòâ°$Ô"« ê¦0A £f ¬¡eÞ¦ü²IR¬æ}5X 4/÷Î8{ÿÄ ' !1AQaq ¡0±ÑÁáðÿÚ ?ü_ÅIJ`~Õï Ëþ Ü4 ûùþÇáùY µü[GðXÆ° 7¿Öh°âti`@ØíÃr¹råËþKqæ#&; ûÌC§>É hiYîH ×þ9¹7{@7M µOPiüØŸý~~ P_Ë¢½pT1ÝÅ53Äùë¸q©F®Ð ûàØù øþ:ÃháT¦ Þ|þñUbg VÒz²`Ä*Îj¾(:EG0ùeüS¸³¹¼´gy#÷÷ÄÅ^¿5ÏÊÜX.¸ ³dé X¨')WGX©SYTaÌÿ § 4§².ß91"on"]ÁX£4Øá £S@ôA¨6BÚ«Qvû<Ïø¬î-pDv+Øä±Bà(- ¸ xLè` ÷ãð· `)$Ð +:¾ï¨cFÀ¬ v ì·fCñ èêê¤JÊ( ½ à@çµê¸?åËø.-bãW¸½ÃPlNY\©sÙÃÎl+Ô¢L(àÆõYF> 'OT¸#óó÷5C¯àJ- ïD¯¼hý°Di ݱT >° _ïÊe<IõËù\V"= *D°VDoxle×jÝÌ´ÁHátßY }7\ÿ ~ñÏÅÿ ~? ó/RüÄ;q /ÑÁàNi9´îAêB4Ý$¿ ¡Õc & ¥ KÏ5Sév}Ø[Ícl ?£c-ÊD ð @P½l©2 ¡×@RUÍõÔÒS¨ ;«xÀS¿ÙMëûü/ã{ÔYX/ÕÁL¢]ù& m éÙ_ùø ,§ÎSçï.\¹* ¬SÃRÙ éZ k z>Õ l ~\nà=Âõý`=0C_ï4P P R7×ÿ ¼Dsôõo,' ¹Ì¾(GE .Øw}C F*«]qm,DÝÚÔPxá Zîu!ùÅYÃT_UåJ¢QhÞµEÁ ) 6b¨¦º:dpæ~¢¾ol1 «jlÏÓ5r¿¢ûÍôªÔºz]|O>_Åf-|( d{ RÇúTKÎ " Í¡Õ**bÒÝYý?éÉ´ z ª@ ¬à×ZÃT Þà.I jº*´ ID\Ø£¥ ýa6Ô=GÀU| ÁÑÍ{Mxc,ûñS*o×x4ÙkÒÜFËÓÀJ6éZjÛUÅ#è´@l¢}þVçÆ>Ñ\³ ¡ÿ ç{2PØM÷Ì*·erÒlJ¨íÔµÝ'Ïôäàt¥¡x[EÔalÇÒ_ÈWçÁ §Î#þ³¦\PÞÿ ÍÆ# @[ [fï°P*¨o"&FKµÒÛM »ÍúÕBé! ,¬=JSd%Ò°²Á! TòFÈŧ 7°¼RAFMhÀtOéÃÖPãvN ¢ÂE du k(¶,EHâpây}ÝÀdâÇáºÄ õù` ßrâßÃó8ì~Å1©ðMÿ GÆUÌY1} `pcyÆÜØ úTïZHB6»0qm@T ªúÕwAv<ÅL>_Åf-üÄà#îR?Y,Q«´w+¸ÑSÌ jÛ×ʺ4E^P:1C3ÅKbèÚÔwûXT$`*á±,dà¬IG!Ð]: ¡¥)Þ#3ÿ 0JYEoh¼nvp ª©°·ÖSzl=²VÛ* n¦ZÈ e Nã/\©èx¡c<¯íü¬ü-ãÔÄEÏÒÂJ$!vtM ¨då:6È(H *ÖRÂV½I©ÙbÃeÔ¥ÆFô§BKWȹH;¨Þ_£5þ3ïÞ <>~úb¿/ÏÇOÞôÉ:4á 9î%Í õ>å/Áê @@ C#TE,n C»Á%Â|QPW"`O³L¨CèR)R¯U+ ÁH RzÃ9ì$V a\ªÉóì!TRÀ,}5U½"SÍÅè:vORЦB! Q½öïþòå~Ãg£ Þ ½Ä%®Þ°¨!B¦ÕFéf/G!»>¬TBl¼-~LÕ>L P ôÑX¿1DP `Y°lÉ1c@_P¬ýW)üÅ®:?×Æ ó§ëÞAMæÏ aÒé³GD°m <>ÁÑ(¦Î¤6¿ Ü% `J© 7KÑùÅåiT7M iëÏYªD3nö'jqù#F4&ºQCHµM3ÐïPºøìß¡¤ºËGUÀTpPã¶ÀÅ®V/Ë|6 ?Fßë C¬þÏóõ\0¬& G5ÑPV* P4t¢ÿ ¤Ìy@ jÒºÀÃg¬ D-=Ì 2ªÍÐvÞåzÕò( 8ÆA*Ö®°EVå @±zw ; UM6×ð#ï'ï *÷ð¼üuü(ðDpoÞ° ©aWÀä]¥VÖêbUWF 6&DID X µðÈ q¥Sýâw ï[=!F%m¸ÎX`´SÇtÈ Ý C¬4 öf»»Þ$± ýGÀÍf þ± .Ï'÷½|ÇQ%(°S°+X'n¾ñ0ûj z ðFî÷eUÒllQé=7¤ÔÈ"0ÙüksË4èuF£g£º4izÞû k]è !âøF4G EÇoÞC¼Á¼þç4aà x ôÄu``W°ôÆâ`ì,DlôI!Ö0D2ÐÚB B;V -ãÄêe9®¢V ®Q>·uÆÔipd#EbtÀF4DÞù» MÒIõ ÁéEÒUÖ×´*´ áEH衱j¢:Å)ânÇSç µ }Ô:;; =ñÏÓ7Ìn.QC6¢I6iã9À£f¨Átu1 Eä.É) ¬ÁnÅE MÒ ¦!lm³é(>Âq5®¶]uhé #¡Ht4Q08T¢Ñôh rýf@ÂlÛ±mî=? Ð}Ãjó ïàg0yX«×ðÜWFÅyà h ¾W D`pNÄm'ÌDIðUùP+LoOÔ wXC¶úf¤®»;ÒÀ÷é¬%?øCFÄ>¼TòªÈò%÷b5ås[P¦Äßµ0 ÂZjøÄÆ ?°©h n¸M`½1~[G pÑKßûÇrfÚkëX«Ô*Db(8dø Ü)zpæ÷HàV¡ÑÅl>µ+ëè´Öi¬ ?¢gcöÀfªJøRê4Mäêj nÊ á 5"h i`¸}~î~ÀÅ>ÌàäK"¡ûe¾ßÏù~?éÂk&£Ç U³,×XlôbÌRWUOÚ¾¸l y0N \hhþRþ©.uöJ°Ð¾Hd£Æ%E«PîæWQ´ ÌÞþ ÀµphE_¥&Kg. ¥%/ÉM}8Ëbaá@þÜ :Îi¨ëKxUaª¯W n"6@'¦·ÒÎâKæj¤APØMÒu¸Hl0 ;*Ãè 5N1³@Ú$6 VJÄ£l}¸À·5ÊU0 éÃ|Á ¹ùÿ ¬XÉC cÛp¹=ÙûÁ8â¿ âÖ¸¯ë¬:?x4~óï"9 y. nB!ø ê¼»1eZ (h SiÐÒ¡Ù,pw* %Sk(> æZÝøÌ ÅT¦<xtë© XEÝSjéÒ?V@¼dÏúY£göfkíà ÒÄx)N%xÓYaq´º tèÞ«¦ÉÔR-éÑy±çÂX4w 5Ó ÞÍD 85³dù@X [ ÐY,í w ÐG¸½( ®fÜc§äɾÿ rꨱáuþqATcµ5g7¤èC 8 ¡ø»ª¥(Àì&ÜôX?L~&"ÞáH wï?Ha©ðÀ÷F OÌó. {t3×û|¸îÝ zíÿ 8¹z6èïM?Øxh¢æ #ѤS£µ@¼¨©U«¾¯qÈtì¼`%lpjÜ)Îãè¬4Ú?F0rGÀ;6GãNæ<=tÄ Iª:R ¨9TºÇ(@üA×¾cm§jJwEÐöÍ1þ2ÔVú_^M ¨Cè8_ϼPA<8³"T°HÆçJ ±@Ö§ÀRäbñ0o3ìÎ/« WÃõê7w" t*)\ ²/ø¨x~îPõâ68G>§x0|«óX_gã FÖ7Òa0¡AeÆcmËí_¬Úíà n @íØp¨-avZb¶Õ±!AØ?X=ON½Jàî0"Á ;NÄÓÏ.¹í4iÁ]:iAà oïæb¼R!zPCªKø?DTv+°jxéÜ£ {ó_£»ëCûÂoNî$³ ï{mÀ¹5ѼK¶+v)TúZë ×FD]\Nù·Â0¥ ¯Ð:¦-EÃF:É$òL Oyõ<Ågã>£6ÖT VíHË{?ó&óÜÐ:MAÒ¬3±Ü /kZÔȳNKfÌÙtßÞ<õ#é¨p¡¸ª~Quyÿ Xkõ×®ñ !N¶: ´¨+ aZÒkt˳p/zPÞÒRXÜ@{úUø2ëêêäõ=G½U¢Pów7§ÔF]¾HýÓ¶{Zÿ °«?x JÂ2°Ò+ ¦ ;i`1«¯YC¥¶ 1ó ;-C±4i! 4Bª´ UP]Ï19áþ`9g{Oð]Sö]åð¯eâ¶DÆÇPÔÝÉa¤0À¤dyjS» ôdÑÕn¡ K¯a мH&%© *ÿ ÚæúΠدgï:X«ë(FáþðwIZ¶ J¦À°ÀÄ|#©z ~±©¯1.4Û rbHgÔ#c¥ÄYA`i.#À£5.áï(;«>¶ qɧúDÔo)Âà§à@d ìg , ÒOÊAÎíÎPIÏð`|=A÷o ý`5v\}ݼ!_ Rn*h R@\é@ãZè/§n81( )â6ù%»¨-ø=>_:Ñ"ÅÙF¦© °mÆÆ9ÀT u¶X~¨N« SÛ¶6ËæR«RSX, 6 úU^)0[𵩽b,àµÃÂÍè N8s®Úèµãà(¼¡\AîÁÞM|Ü 04çÃ4ÏóÁ_5³ó·$i4¾d¸:64j&´` &¢åL ôÑLnèðÄæÙ:8DêzÆDBa¯wG0R©Ü#¹PjT¥UØÜDÌ TÙ®kì ¬îT/W p)Jªáah"ÅZóçë¬%ê×»oËmq4P!%© DÀC@ ÂFuvë`ß»åøÞ.Ì©ZD *×ý}ê¶2½Â<<eKUZ ôDøлÅÉóù*"ggxÝ)Ú èH½©NØó} » `©]5¥¬å¦=³,º¨. nÖëX% èpÇØ"àÃ:1ÚºDØâ²M/V¿³á´Ãm¸giäÏCû0ñÏ«5 c_¤iõíozßÀ 8b¯z0Ó³$%lc=éÍà¤]0¶1Èï®$²Ò/ ]mØ {? A-Ú)W«UUP4Ô=ä@P¢[H, û¹å£DaB!)Ûk)OÒVR»<bãô¡Öe¼´|¶à®n¨BƲ¯7¹<ää `&écܲ,Q£ºÈ{(Ô A]qà øENjµÕQÖȧ©WÅ^ ÖÛÐ £¦FpÜØMHÍl×g¼ÉBoÈvo@]Ϊh nîÅÍ¡A0 ÞÖ¢"SûÈá >¶õ5MBWrN¸@oT±Ý 'ô¢nÏSîòx?-ðW¸áQ¥,ý «à9¬Gö|àFbÛÞ`ÊYL¦ípP|8×ñ.Ë$( Ö*wöþó ëë}¼Á?·É .cª¬bSáÓèBÞìè ÂhkÓX6]JG k{Ôn3ZW/æ%I' Nã t ÀñÊ»°ú1D*Æ*Ð 6¡0&ÉÏÈÿ x )"µ²ßè0ü:øÆ~éƤW¨ÎY±FwÖ iôØ×âFUñyTy´ ]\h"'Îé7) ,¡ZBmäq\y kÔ?VdÖWUk@çÜ â¨$*Di[+ ( }1Ò%UÖð°"8è$U!V3ÆûT°]h+@'A:LãK×@©£UÁ!VhFDU²¬"©(í 4SEÁlÁ.ÛG^ ((:wÑÆ>çÐdBóþ²J'¯FHõmÚ5 f@» KÙ¢ 1¢I Uv«î4aè)ðdï\@ ^`T=ÔU1ÍÁ}¾4Ha ä±¹ k#§¡ ! ¤i Ö@pè,ÜU°"@ Ûè3P tÑpMÌ£Æ`g C,ob,éD×t)j¯ Áhðiùuc0S¢-mB;·£4ÍA¨XÊCø x ¨Q`¤Æùvº{þñý) ]_°%öß"_aGÇáh¨B1GäO» ñË?ÿÙ |
| URL | http://testphp.vulnweb.com/signup.php |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 296 bytes. |
GET http://testphp.vulnweb.com/signup.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com/login.php |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 6033 |
| Response Body - size: 6,033 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>signup</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <h2 id="pageName">Signup new user</h2> <h4>Please do not enter real information here.</h4> <h4>If you press the submit button you will be transferred to asecured connection.</h4> <form name="form1" method="post" action="/secured/newuser.php"> <table border="0" cellspacing="1" cellpadding="4"> <tr><td valign="top">Username:</td><td><input type="text" name="uuname" style="width:200px"></td></tr> <tr><td valign="top">Password:</td><td><input type="password" name="upass" style="width:200px"></td></tr> <tr><td valign="top">Retype password:</td><td><input type="password" name="upass2" style="width:200px"></td></tr> <tr><td valign="top">Name:</td><td><input type="text" name="urname" style="width:200px"></td></tr> <tr><td valign="top">Credit card number:</td><td><input type="text" name="ucc" style="width:200px"></td></tr> <tr><td valign="top">E-Mail:</td><td><input type="text" name="uemail" style="width:200px"></td></tr> <tr><td valign="top">Phone number:</td><td><input type="text" name="uphone" style="width:200px"></td></tr> <tr><td valign="top">Address:</td><td><textarea wrap="soft" name="uaddress" rows="5" style="width:200px"></textarea></td></tr> <tr><td colspan="2" align="right"><input type="submit" value="signup" name="signup"></td></tr> </table> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/style.css |
| Method | GET |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 285 bytes. |
GET http://testphp.vulnweb.com/style.css HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache referer: http://testphp.vulnweb.com |
| Request Body - size: 0 bytes. |
|
| Response Header - size: 343 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:00 GMT Content-Type: text/css Content-Length: 5482 Last-Modified: Wed, 11 May 2011 10:27:48 GMT ETag: "4dca64a4-156a" Accept-Ranges: bytes X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: 1.1 localhost (squid/5.8) Connection: keep-alive |
| Response Body - size: 5,482 bytes. |
body{
font-family: Arial,sans-serif; color: #333333; line-height: 1.166; margin: 0px; padding: 0px; } a:link, a:visited{ color: #006699; text-decoration: none; } a:hover { text-decoration: underline; } h1, h2, h3, h4, h5, h6 { font-family: Arial,sans-serif; margin: 0px; padding: 0px; } h1{ font-family: Verdana,Arial,sans-serif; font-size: 120%; color: #334d55; } h2{ font-size: 114%; color: #006699; } h3{ font-size: 100%; color: #334d55; } h4{ font-size: 100%; font-weight: normal; color: #333333; } h5{ font-size: 100%; color: #334d55; } ul{ list-style-type: square; } ul ul{ list-style-type: disc; } ul ul ul{ list-style-type: none; } label{ font: bold 100% Arial,sans-serif; color: #334d55; } /***********************************************/ /* Layout Divs */ /***********************************************/ #masthead{ margin: 0; padding: 10px 0px; border-bottom: 1px solid #cccccc; width: 100%; } #navBar{ margin: 0 79% 0 0; padding: 0px; background-color: #eeeeee; border-right: 1px solid #ccc; border-bottom: 1px solid #ccc; } #content{ float:right; width: 75%; margin: 0; padding: 0 3% 0 0; } /***********************************************/ /*Component Divs */ /***********************************************/ #siteName{ margin: 0px; padding: 0px 0px 10px 10px; } /*************** #pageName styles **************/ #pageName{ padding: 0px 0px 10px 10px; } /************* #globalNav styles **************/ #globalNav{ color: #cccccc; padding: 0px 0px 0px 10px; white-space: nowrap; } /* 'nowrap' prevents links from line-wrapping if there are too many to fit in one line this will force a horizontal scrollbar if there isn't enough room for all links remove rule or change value to 'normal' if you want the links to line-wrap */ #globalNav img{ display: block; } #globalNav a { font-size: 90%; padding: 0px 4px 0px 0px; } /************* #breadCrumb styles *************/ #breadCrumb{ font-size: 80%; padding: 5px 0px 5px 10px; } /************** .feature styles ***************/ .feature{ padding: 0px 0px 10px 10px; font-size: 80%; } .feature h3{ padding: 30px 0px 5px 0px; text-align: center; } .feature img{ float: left; padding: 0px 10px 0px 0px; margin: 0 5px 5px 0; } /* adjust margins to change separation between the feature image and text flowing around it */ /************** .story styles *****************/ .story{ clear: both; padding: 10px 0px 0px 10px; font-size: 80%; background-color:#FFFFFF; } .story p{ padding: 0px 0px 10px 0px; background-color:#FFFFFF; } /************* #siteInfo styles ***************/ #siteInfo{ clear: both; border: 1px solid #cccccc; font-size: 75%; color: #cccccc; padding: 10px 10px 10px 10px; margin-top: -1px; } /* negative top margin pulls siteinfo up so its top border overlaps (and thus lines up with) the bottom border of the navBar in cases where they "touch" */ #siteInfo img{ padding: 4px 4px 4px 0px; vertical-align: middle; } /************* #search styles ***************/ #search{ padding: 5px 0px 5px 10px; border-bottom: 1px solid #cccccc; font-size: 90%; } #search form{ margin: 0px; padding: 0px; } #search label{ display: block; margin: 0px; padding: 0px; } /*********** #navBar link styles ***********/ #navBar ul a:link, #navBar ul a:visited {display: block;} #navBar ul {list-style: none; margin: 0; padding: 0;} /* hack to fix IE/Win's broken rendering of block-level anchors in lists */ #navBar li {border-bottom: 1px solid #EEE;} /* fix for browsers that don't need the hack */ html>body #navBar li {border-bottom: none;} /*********** #sectionLinks styles ***********/ #sectionLinks{ position: relative; margin: 0px; padding: 0px; border-bottom: 1px solid #cccccc; font-size: 90%; } #sectionLinks h3{ padding: 10px 0px 2px 10px; } #sectionLinks a:link{ padding: 2px 0px 2px 10px; border-top: 1px solid #cccccc; width: 100%; voice-family: "\"}\""; voice-family:inherit; width: auto; } #sectionLinks a:visited{ border-top: 1px solid #cccccc; padding: 2px 0px 2px 10px; } #sectionLinks a:hover{ border-top: 1px solid #cccccc; background-color: #dddddd; padding: 2px 0px 2px 10px; } /*********** .relatedLinks styles ***********/ .relatedLinks{ margin: 0px; padding: 0px 0px 10px 10px; font-size: 90%; } .relatedLinks h3{ padding: 10px 0px 2px 0px; } /************** #advert styles **************/ #advert{ padding: 10px 0px 0px 10px; font-size: 80%; border-top: 1px solid #cccccc; } #advert img{ display: block; } /************** #headlines styles **************/ #headlines{ margin: 0px; padding: 10px 0px 20px 10px; font-size: 80%; } #headlines p{ padding: 5px 0px 5px 0px; } img { border: none; padding: 0px 10px 0px 0px; } input { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } textarea { font-family:Verdana,Sans-serif; font-size:10px; border-style:ridge; background-color:#F5F5F5; } table { background-color:#EEEEEE; } td { background-color:#FFFFFF; } |
| URL | http://testphp.vulnweb.com/cart.php |
| Method | POST |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 372 bytes. |
POST http://testphp.vulnweb.com/cart.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/product.php?pic=1 content-length: 19 |
| Request Body - size: 19 bytes. |
price=500&addcart=1
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:06 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4903 |
| Response Body - size: 4,903 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>you cart</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>Error</h2> <div class='story'> <p>You are not logged on. To log on please visit our <a href='login.php'>login page</a></p> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/guestbook.php |
| Method | POST |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 373 bytes. |
POST http://testphp.vulnweb.com/guestbook.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/guestbook.php content-length: 33 |
| Request Body - size: 33 bytes. |
name=ZAP&text=&submit=add+message
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 5393 |
| Response Body - size: 5,393 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>guestbook</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <div class="story"> <table width="100%" cellpadding="4" cellspacing="1"><tr><td colspan="2"><h2>Our guestbook</h2></td></tr><tr><td align="left" valign="middle" style="background-color:#F5F5F5"><strong>ZAP</strong></td><td align="right" style="background-color:#F5F5F5">04.01.2025, 5:52 am</td></tr><tr><td colspan="2"><img src="/images/remark.gif"> </td></tr></table> </div> <div class="story"> <form action="" method="post" name="faddentry"> <input type="hidden" name="name" value="anonymous user"> <textarea name="text" rows="5" wrap="VIRTUAL" style="width:500px;"></textarea> <br> <input type="submit" name="submit" value="add message"> </form> </div> </div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/search.php?test=query |
| Method | POST |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 367 bytes. |
POST http://testphp.vulnweb.com/search.php?test=query HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com content-length: 25 |
| Request Body - size: 25 bytes. |
searchFor=ZAP&goButton=go
|
| Response Header - size: 407 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:01 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 4772 |
| Response Body - size: 4,772 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd"> <html><!-- InstanceBegin template="/Templates/main_dynamic_template.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2"> <!-- InstanceBeginEditable name="document_title_rgn" --> <title>search</title> <!-- InstanceEndEditable --> <link rel="stylesheet" href="style.css" type="text/css"> <!-- InstanceBeginEditable name="headers_rgn" --> <!-- here goes headers headers --> <!-- InstanceEndEditable --> <script language="JavaScript" type="text/JavaScript"> <!-- function MM_reloadPage(init) { //reloads the window if Nav4 resized if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) { document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }} else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload(); } MM_reloadPage(true); //--> </script> </head> <body> <div id="mainLayer" style="position:absolute; width:700px; z-index:1"> <div id="masthead"> <h1 id="siteName"><a href="https://www.acunetix.com/"><img src="images/logo.gif" width="306" height="38" border="0" alt="Acunetix website security"></a></h1> <h6 id="siteInfo">TEST and Demonstration site for <a href="https://www.acunetix.com/vulnerability-scanner/">Acunetix Web Vulnerability Scanner</a></h6> <div id="globalNav"> <table border="0" cellpadding="0" cellspacing="0" width="100%"><tr> <td align="left"> <a href="index.php">home</a> | <a href="categories.php">categories</a> | <a href="artists.php">artists </a> | <a href="disclaimer.php">disclaimer</a> | <a href="cart.php">your cart</a> | <a href="guestbook.php">guestbook</a> | <a href="AJAX/index.php">AJAX Demo</a> </td> <td align="right"> </td> </tr></table> </div> </div> <!-- end masthead --> <!-- begin content --> <!-- InstanceBeginEditable name="content_rgn" --> <div id="content"> <h2 id='pageName'>searched for: ZAP</h2></div> <!-- InstanceEndEditable --> <!--end content --> <div id="navBar"> <div id="search"> <form action="search.php?test=query" method="post"> <label>search art</label> <input name="searchFor" type="text" size="10"> <input name="goButton" type="submit" value="go"> </form> </div> <div id="sectionLinks"> <ul> <li><a href="categories.php">Browse categories</a></li> <li><a href="artists.php">Browse artists</a></li> <li><a href="cart.php">Your cart</a></li> <li><a href="login.php">Signup</a></li> <li><a href="userinfo.php">Your profile</a></li> <li><a href="guestbook.php">Our guestbook</a></li> <li><a href="AJAX/index.php">AJAX Demo</a></li> </li> </ul> </div> <div class="relatedLinks"> <h3>Links</h3> <ul> <li><a href="http://www.acunetix.com">Security art</a></li> <li><a href="https://www.acunetix.com/vulnerability-scanner/php-security-scanner/">PHP scanner</a></li> <li><a href="https://www.acunetix.com/blog/articles/prevent-sql-injection-vulnerabilities-in-php-applications/">PHP vuln help</a></li> <li><a href="http://www.eclectasy.com/Fractal-Explorer/index.html">Fractal Explorer</a></li> </ul> </div> <div id="advert"> <p> <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="107" height="66"> <param name="movie" value="Flash/add.swf"> <param name=quality value=high> <embed src="Flash/add.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="107" height="66"></embed> </object> </p> </div> </div> <!--end navbar --> <div id="siteInfo"> <a href="http://www.acunetix.com">About Us</a> | <a href="privacy.php">Privacy Policy</a> | <a href="mailto:wvs@acunetix.com">Contact Us</a> | ©2019 Acunetix Ltd </div> <br> <div style="background-color:lightgray;width:100%;text-align:center;font-size:12px;padding:1px"> <p style="padding-left:5%;padding-right:5%"><b>Warning</b>: This is not a real shop. This is an example PHP application, which is intentionally vulnerable to web attacks. It is intended to help you test Acunetix. It also helps you understand how developer errors and bad configuration may let someone break into your website. You can use it to test other tools and your manual hacking skills as well. Tip: Look for potential SQL Injections, Cross-site Scripting (XSS), and Cross-site Request Forgery (CSRF), and more.</p> </div> </div> </body> <!-- InstanceEnd --></html> |
| URL | http://testphp.vulnweb.com/secured/newuser.php |
| Method | POST |
| Parameter | x-content-type-options |
| Attack | |
| Evidence | |
| Request Header - size: 376 bytes. |
POST http://testphp.vulnweb.com/secured/newuser.php HTTP/1.1
host: testphp.vulnweb.com user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache content-type: application/x-www-form-urlencoded referer: http://testphp.vulnweb.com/signup.php content-length: 96 |
| Request Body - size: 96 bytes. |
uuname=ZAP&upass=ZAP&upass2=ZAP&urname=ZAP&ucc=ZAP&uemail=ZAP&uphone=ZAP&uaddress=&signup=signup
|
| Response Header - size: 406 bytes. |
HTTP/1.1 200 OK
Server: nginx/1.19.0 Date: Tue, 01 Apr 2025 05:52:02 GMT Content-Type: text/html; charset=UTF-8 X-Powered-By: PHP/5.6.40-38+ubuntu20.04.1+deb.sury.org+1 X-Cache: MISS from localhost X-Cache-Lookup: MISS from localhost:3128 Via: ICAP/1.0 BOBeProcure.BOBeProcure (C-ICAP/0.5.10 SquidClamav/Antivirus service ), 1.1 localhost (squid/5.8) Connection: keep-alive content-length: 733 |
| Response Body - size: 733 bytes. |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html> <head> <title>add new user</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <link href="style.css" rel="stylesheet" type="text/css"> </head> <body> <div id="masthead"> <h1 id="siteName">ACUNETIX ART</h1> </div> <div id="content"> <p>You have been introduced to our database with the above informations:</p><ul><li>Username: ZAP</li><li>Password: ZAP</li><li>Name: ZAP</li><li>Address: </li><li>E-Mail: ZAP</li><li>Phone number: ZAP</li><li>Credit card: ZAP</li></ul><p>Now you can login from <a href='http://testphp.vulnweb.com/login.php'>here.</p></div> </body> </html> |
| Instances | 68 |
| Solution |
Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
|
| Reference |
https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)
https://owasp.org/www-community/Security_Headers |
| Tags |
CWE-693
OWASP_2021_A05 OWASP_2017_A06 |
| CWE Id | 693 |
| WASC Id | 15 |
| Plugin Id | 10021 |
